Behavioral task
behavioral1
Sample
b21af9dfab1a132033ac410c56a2ab89e721a0b254005ae549350b002521f393.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b21af9dfab1a132033ac410c56a2ab89e721a0b254005ae549350b002521f393.exe
Resource
win10v2004-20221111-en
General
-
Target
b21af9dfab1a132033ac410c56a2ab89e721a0b254005ae549350b002521f393
-
Size
152KB
-
MD5
da5577c8b22451f75496b81e43bf6ea9
-
SHA1
07a6e392a95a9ba2c7907d9f738d16c3d9bdfba5
-
SHA256
b21af9dfab1a132033ac410c56a2ab89e721a0b254005ae549350b002521f393
-
SHA512
043c0adf698dffe84c99f64f3b4a243146e91e52965d245219d52403731da44e94f0b9c11ab09cd0fce55d051f2379d62eb7d6c53f66e3f6937ba90bcc1ed3e7
-
SSDEEP
3072:nrfdDktVKcrmoC4kR4HdRvIOtfEFla5byIKqpY3SR4:nryzKcPC44NlXy4
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
b21af9dfab1a132033ac410c56a2ab89e721a0b254005ae549350b002521f393.exe windows x86
9c8decf3582072f6edfc385a689f44f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 57KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 43KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE