Behavioral task
behavioral1
Sample
eece59c471c16812c53c4629e8d6befb14c39dba92f47d9cbdc38096ad2c4a86.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eece59c471c16812c53c4629e8d6befb14c39dba92f47d9cbdc38096ad2c4a86.exe
Resource
win10v2004-20221111-en
General
-
Target
eece59c471c16812c53c4629e8d6befb14c39dba92f47d9cbdc38096ad2c4a86
-
Size
8KB
-
MD5
ebc7d7b3aeeee426f47bd8da3236fbfc
-
SHA1
aec212064bdca6eaa71e90e0142e90b59fa9bf94
-
SHA256
eece59c471c16812c53c4629e8d6befb14c39dba92f47d9cbdc38096ad2c4a86
-
SHA512
752fd38151abef77cc846f15fcace6902499aec8f473bd03a39a095bf98ad1c4c95f96f05f3effd2cf77a8f33a9dbc1928b74f26f057d125d5b483ec39734995
-
SSDEEP
192:8nDKk0wgLNDz0ngkKUpt8/nUpOW5/EyXdd:8DKk0wg5DzkZDpecOW5cyXn
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx
Files
-
eece59c471c16812c53c4629e8d6befb14c39dba92f47d9cbdc38096ad2c4a86.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE