Behavioral task
behavioral1
Sample
sample-20190115-unpacked.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sample-20190115-unpacked.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
sample-20190115.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
sample-20190115.exe
Resource
win10v2004-20230220-en
General
-
Target
exam20190115sample.7z
-
Size
59KB
-
MD5
f9080528742fcc32a42e3c6264bcab1e
-
SHA1
2729c5eab60519361e78ad729d0bbf030179f3bc
-
SHA256
9692486116d644b908652b094b8816612e6a82e045382a3b5c4f2c0a0e450467
-
SHA512
230855519789c153026c80da7eaa2b8ef61ad936600745e1348fc13bdc4bbd8616abd2a7fa8a03ce0b2121e82f4f545f715ce2913c5c36cf81226e3fac0f57a9
-
SSDEEP
1536:JEwCnhRTqeLXHNSOHGGhlEfD9UIPKRQBaR0RoQr8:QEezTGGhED9wQBMHo8
Malware Config
Signatures
-
resource yara_rule static1/unpack001/sample-20190115.exe upx
Files
-
exam20190115sample.7z.7z
Password: infected
-
sample-20190115-unpacked.exe.exe windows x86
e52f282672b49ca20a95868c45883f49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
CloseHandle
WriteFile
CreateFileA
ExitProcess
GetFileAttributesA
CreateProcessA
GetModuleHandleA
GetProcAddress
WriteProcessMemory
VirtualAllocEx
UnhandledExceptionFilter
GetCurrentProcess
FindResourceA
LoadResource
LockResource
SizeofResource
VirtualAlloc
CreateRemoteThread
FreeResource
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
SetUnhandledExceptionFilter
EncodePointer
IsDebuggerPresent
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
user32
MessageBoxA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
shell32
SHGetFolderPathA
msvcr100
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
exit
_XcptFilter
_exit
_cexit
_amsg_exit
memset
strcpy
strlen
malloc
strcat
memcpy
__getmainargs
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
sample-20190115.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 33KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE