Behavioral task
behavioral1
Sample
6184738c4f94b4946e03e2dc2c5741772c529f852f6c9a8d312d731b878583a5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6184738c4f94b4946e03e2dc2c5741772c529f852f6c9a8d312d731b878583a5.exe
Resource
win10v2004-20220812-en
General
-
Target
6184738c4f94b4946e03e2dc2c5741772c529f852f6c9a8d312d731b878583a5
-
Size
27KB
-
MD5
6aebfd3ab6745f9272c4984674a315c4
-
SHA1
db4d4e0f6072ebdc3cece026fd90c28595500372
-
SHA256
6184738c4f94b4946e03e2dc2c5741772c529f852f6c9a8d312d731b878583a5
-
SHA512
b168120fe29cd250fa002c08da8e079be6d72417026035f794186232b1d1fd3947a9576d7d8e27c0807b6bcba135dab3d6ba4fca744a76ae446ffbbc0171242c
-
SSDEEP
384:pEK4yFhuCTf+7y/TkT/3GaYGaYGaYGaYGaYGaYGaYGajLOGcX:pHbhuCTfX/Tkb24444444g9i
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
6184738c4f94b4946e03e2dc2c5741772c529f852f6c9a8d312d731b878583a5.exe windows x86
f1438212155f3e561b14c0bd55ddeae5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitThread
SetEvent
GetTickCount
TerminateThread
WaitForSingleObject
CreateThread
CreateEventA
ReadFile
TerminateProcess
GetFileSize
_llseek
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetStartupInfoA
GetShortPathNameA
lstrcpyA
lstrcatA
GetEnvironmentVariableA
GetLastError
CreateFileA
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
Sleep
OpenProcess
GetModuleFileNameA
VirtualFree
GetWindowsDirectoryA
GetSystemDirectoryA
FindFirstFileA
DeleteFileA
VirtualAlloc
advapi32
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
RegCloseKey
RegSetValueExA
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegQueryValueExA
CryptHashData
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??3@YAXPAX@Z
strcat
sprintf
_except_handler3
_local_unwind2
memset
memcmp
strncpy
strlen
strcmp
strstr
strcpy
__CxxFrameHandler
toupper
tolower
__dllonexit
_onexit
shell32
ShellExecuteA
Sections
UPX0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE