Behavioral task
behavioral1
Sample
bf4f52ed4393792dbf06fbbf3516552acdc1f54ea458958cbed7cf9a99887453.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bf4f52ed4393792dbf06fbbf3516552acdc1f54ea458958cbed7cf9a99887453.exe
Resource
win10v2004-20220812-en
General
-
Target
bf4f52ed4393792dbf06fbbf3516552acdc1f54ea458958cbed7cf9a99887453
-
Size
75KB
-
MD5
4bbdedbf260cd5f0f217ba6f1baa1c1d
-
SHA1
df39e4e72bfc9cb0f109035b6b41a552e048e06b
-
SHA256
bf4f52ed4393792dbf06fbbf3516552acdc1f54ea458958cbed7cf9a99887453
-
SHA512
683a05ac22dbd90a357ec18f7d4f308da8cd9996d61f920fc2c68075d440698c373b92a15ab4bcbeb3c2eadcbe4928d53f6d8aa68aea9a0491c4c7951e1a91be
-
SSDEEP
768:by/d8BbVsjmLl0HGRKVyqKiwJ65BG575vcqowtFnbcuyD7UzoMJJIyE83V/:uCBbVsjmJa5M65BONVowHnouy88mB
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx
Files
-
bf4f52ed4393792dbf06fbbf3516552acdc1f54ea458958cbed7cf9a99887453.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE