Behavioral task
behavioral1
Sample
b0f71a0b80796a5888c52bd8db0902c6c659561dcee3e8c3da8c136f3a96eb3c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b0f71a0b80796a5888c52bd8db0902c6c659561dcee3e8c3da8c136f3a96eb3c.exe
Resource
win10v2004-20221111-en
General
-
Target
b0f71a0b80796a5888c52bd8db0902c6c659561dcee3e8c3da8c136f3a96eb3c
-
Size
194KB
-
MD5
baf379511347cfeb7b357bfbee4b6d76
-
SHA1
2081c20cef8e4d9b9b4642cb503bcbbbd80a410b
-
SHA256
b0f71a0b80796a5888c52bd8db0902c6c659561dcee3e8c3da8c136f3a96eb3c
-
SHA512
aa682bd070d6777357b2d446dabd63cb2cbed4cb47fb1298563b89eaaa2e6758dec7362dcaf1d966aa42efefdb788d96407b5846dac31ef2be8ab8fe40600e4e
-
SSDEEP
3072:PYY5z1i0Nmbi5fJBNGwfMBVuroutHaLFDVFM6++2tF/3B8EPhr44l0/b5:Aj0NmWtNjfucroS6LFDPMTJjhr44e/
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx
Files
-
b0f71a0b80796a5888c52bd8db0902c6c659561dcee3e8c3da8c136f3a96eb3c.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 284KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE