Behavioral task
behavioral1
Sample
c01bc2d27269354c4ec56acd2330670aa60738a475114b4320f56455e3266da5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c01bc2d27269354c4ec56acd2330670aa60738a475114b4320f56455e3266da5.exe
Resource
win10v2004-20220812-en
General
-
Target
c01bc2d27269354c4ec56acd2330670aa60738a475114b4320f56455e3266da5
-
Size
213KB
-
MD5
8ce7e02e27e63ddbafec4251f70d4865
-
SHA1
5aebc35984bd619a4db5fc8d39372dc68e42ebe2
-
SHA256
c01bc2d27269354c4ec56acd2330670aa60738a475114b4320f56455e3266da5
-
SHA512
8ab808429b1705767a8566cb622c7a5f893203ed6e92b58a0a98fd31b6a8e047e8890a04657bf38ce062e06ae113b84f3a66239332024b09de62faadd515439e
-
SSDEEP
3072:0ZugEDiPARzUarzNUCuwJvfhn1Rr7azXnlanB4NaUfKsdHrn14+2jJ9mA:04gEDxRA8Rvfh1waBTUfKsdHTfQ
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c01bc2d27269354c4ec56acd2330670aa60738a475114b4320f56455e3266da5.exe windows x86
8864948b624a33b260714f546b0b4009
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateFileA
CreateThread
DeleteFileA
ExitProcess
ExitThread
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempFileNameA
GetTempPathA
GetVersionExA
LoadLibraryA
LoadLibraryExA
OpenProcess
WriteProcessMemory
VirtualAlloc
VirtualFree
WriteFile
Sections
UPX0 Size: - Virtual size: 416KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 120KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pe Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.orpc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE