Behavioral task
behavioral1
Sample
9d1794fc6ebf9245f1f53122bac345fe428ebebc7f64ecbb089caa844d0723c7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9d1794fc6ebf9245f1f53122bac345fe428ebebc7f64ecbb089caa844d0723c7.exe
Resource
win10v2004-20220812-en
General
-
Target
9d1794fc6ebf9245f1f53122bac345fe428ebebc7f64ecbb089caa844d0723c7
-
Size
200KB
-
MD5
ef81d4a52adb1601704ee3ef099406f7
-
SHA1
c5956586d87961be819fce338c0b30724467aa91
-
SHA256
9d1794fc6ebf9245f1f53122bac345fe428ebebc7f64ecbb089caa844d0723c7
-
SHA512
77fc70776706b3733cf5592e92bc0825fec3c347c3da06949c116c2fa30f64954a190207d7207c5f0dceb14de03e3c9e972125a30efad707143c8db5cfb3a6ff
-
SSDEEP
3072:sErnhGvzqQXy7afsOWEVOTCGzPNZqzJzYRwLN0jNJ7:Z+nyOEOWEuCsPNIJ0IN0v
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
9d1794fc6ebf9245f1f53122bac345fe428ebebc7f64ecbb089caa844d0723c7.exe windows x86
a6181774cf72119cc700959ace1ab332
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
OpenServiceA
OpenSCManagerA
ControlService
CloseServiceHandle
ChangeServiceConfigA
user32
GetKeyboardType
DestroyWindow
MessageBoxA
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
VirtualQuery
GetStartupInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WriteProcessMemory
WriteFile
WinExec
VirtualProtectEx
Sleep
SetFileAttributesA
OpenProcess
LoadLibraryA
GetVersionExA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
FreeLibrary
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
CreateFileA
CloseHandle
shell32
SHFileOperationA
Sections
.BJFnt Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.peco Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pklstb Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.petite Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WWPACK Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nPack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE