Behavioral task
behavioral1
Sample
21cce24796a38b09302bd3e20d48c762ab255d00d5e91c8f0c9d7478d1226ee6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
21cce24796a38b09302bd3e20d48c762ab255d00d5e91c8f0c9d7478d1226ee6.exe
Resource
win10v2004-20220812-en
General
-
Target
21cce24796a38b09302bd3e20d48c762ab255d00d5e91c8f0c9d7478d1226ee6
-
Size
258KB
-
MD5
f4ff7acc59cad167a9b6705b8d30362c
-
SHA1
4367d74aed547d25e04815342b1a2f40bdf9ae81
-
SHA256
21cce24796a38b09302bd3e20d48c762ab255d00d5e91c8f0c9d7478d1226ee6
-
SHA512
ec9cd258e798be754bae3604d8d3f668f407c718f37b057ea0a8059a9d31c92fd78e4d23b635601c0bd096605457990e26e786246437ac9e57f374687696e435
-
SSDEEP
6144:xAZjhKOftnMxuemFT+M+fHFsBu5tiJ1cZaoO5yFB0kOrFpfWx:IgmtnM+l+bdbtiJ1cDO5G0rWx
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
21cce24796a38b09302bd3e20d48c762ab255d00d5e91c8f0c9d7478d1226ee6.exe windows x86
adbb1fa61b9098e1109d70c4ea1c5f07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
Sleep
GetFileAttributesW
GetVersion
GetLogicalDriveStringsW
FindResourceW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
lstrcpynA
lstrlenA
GetLastError
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetModuleHandleW
LoadLibraryW
FreeLibrary
GetCurrentProcess
MultiByteToWideChar
GetCurrentThread
GetTickCount
CreateDirectoryW
SystemTimeToFileTime
GetThreadPriority
GetSystemTime
InitializeCriticalSection
BeginUpdateResourceW
GetProcAddress
LoadLibraryA
user32
SetTimer
advapi32
AllocateAndInitializeSid
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RevertToSelf
OpenProcessToken
FreeSid
EqualSid
GetTokenInformation
RegDeleteKeyW
RegDeleteKeyA
SetThreadToken
DuplicateToken
OpenThreadToken
shell32
SHGetDesktopFolder
mssip32
CryptSIPVerifyIndirectData
CryptSIPCreateIndirectData
ncobjapi
WmiDestroyObject
Sections
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 2KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX1 Size: 82KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 140KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ