Behavioral task
behavioral1
Sample
18ce5d2696fbd0e610178e8cd59a9174856a711fc07aa7e9130f2fdfe5786ad9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
18ce5d2696fbd0e610178e8cd59a9174856a711fc07aa7e9130f2fdfe5786ad9.exe
Resource
win10v2004-20221111-en
General
-
Target
18ce5d2696fbd0e610178e8cd59a9174856a711fc07aa7e9130f2fdfe5786ad9
-
Size
463KB
-
MD5
8f8434b9694d75c80cdd0a82c68f34e7
-
SHA1
efedbdef57b36d8d8c40a9ab839857203b9745c3
-
SHA256
18ce5d2696fbd0e610178e8cd59a9174856a711fc07aa7e9130f2fdfe5786ad9
-
SHA512
ffeca4e4e31ca07c3f931cb5cd7c5c60ce942778535f92a774cdcead7f2ef075d8cd245a12eb00cc82cc7f31039760fe9d3dea428fc49d24f278da5c7cc534da
-
SSDEEP
12288:wf4EBh4CgZOQxmPvu3VYfypjMK4CZcP2So/Zo:wf4EBheZOwmPvu5jMBt+x
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
18ce5d2696fbd0e610178e8cd59a9174856a711fc07aa7e9130f2fdfe5786ad9.exe windows x86
8864948b624a33b260714f546b0b4009
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateFileA
CreateThread
DeleteFileA
ExitProcess
ExitThread
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempFileNameA
GetTempPathA
GetVersionExA
LoadLibraryA
LoadLibraryExA
OpenProcess
WriteProcessMemory
VirtualAlloc
VirtualFree
WriteFile
Sections
UPX0 Size: - Virtual size: 276KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 86KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pe Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX0 Size: - Virtual size: 572KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 324KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE