Behavioral task
behavioral1
Sample
98ae4bed732d1a753d35b9d0a9bfebcb4e9d2fe5158b61d795c266f6ab2eddcf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98ae4bed732d1a753d35b9d0a9bfebcb4e9d2fe5158b61d795c266f6ab2eddcf.exe
Resource
win10v2004-20220812-en
General
-
Target
98ae4bed732d1a753d35b9d0a9bfebcb4e9d2fe5158b61d795c266f6ab2eddcf
-
Size
54KB
-
MD5
ca2b8d7abed0a6a30ca449a4aee18073
-
SHA1
70feab16e3b29d9d186d0361b6e04eb54ba9c9af
-
SHA256
98ae4bed732d1a753d35b9d0a9bfebcb4e9d2fe5158b61d795c266f6ab2eddcf
-
SHA512
6edc13ad77c737ddb40e78206c5c0a21ef0d7512895ccca3a7b34aefc9f319a3c3d90b7a70c546a30c1aee47017844437038b8e567915c14f4b78916591870e7
-
SSDEEP
768:F1DkW4G2qC8m2ba0AQsoA1ht23I2TrC+zsoNdctyOELGD32yzVQJlY3D75AslY4V:ThFC8mNGYaelcd6lEar2cQ43DVAsm4V
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx
Files
-
98ae4bed732d1a753d35b9d0a9bfebcb4e9d2fe5158b61d795c266f6ab2eddcf.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 51KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE