Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
update.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
update.exe
Resource
win10v2004-20220812-en
General
-
Target
827fcf68553876d1400db7ec04f493965c65a355c91237316b949102d082b9c8
-
Size
154KB
-
MD5
44264f1b27c62d76af31eb935c53b274
-
SHA1
93829f5f914032927aa2af20e78a58ca10d695da
-
SHA256
827fcf68553876d1400db7ec04f493965c65a355c91237316b949102d082b9c8
-
SHA512
b5ad372740c537b8afc5051399617a52e100586c2c2af6f6716292e454fd0b1345209b1378494ec9babc07a588660f99ba8ad0db20016c3b5347b2e1afd10261
-
SSDEEP
3072:qdIIJEkTR04wX9CmHaYH1PRTjb4cCLDeGneHdepqZLHYDw:0/WkO9CUaYFRpCLDzecqZkU
Malware Config
Signatures
-
resource yara_rule static1/unpack001/keygen.exe upx
Files
-
827fcf68553876d1400db7ec04f493965c65a355c91237316b949102d082b9c8.cab
-
keygen.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 140KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
update.exe.exe windows x86
b92d6d6a769fba2d8a998369214f6b85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
DialogBoxParamA
DestroyWindow
DestroyIcon
DestroyCursor
CreateIcon
CreateDialogIndirectParamA
CreateDesktopA
CopyRect
CopyImage
CharUpperBuffA
CharUpperA
CharToOemA
CharPrevA
ActivateKeyboardLayout
kernel32
GetDateFormatA
lstrcpynA
lstrcpyA
lstrcmpiA
lstrcatA
VirtualFree
TlsAlloc
SleepEx
Sleep
SetCurrentDirectoryA
ReadFile
RaiseException
LocalAlloc
GetVersionExA
GetVersion
EnterCriticalSection
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceTypesA
ExitProcess
GetFileSize
GetLastError
GetPrivateProfileStringA
GetStartupInfoA
GetSystemTime
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE