Static task
static1
Behavioral task
behavioral1
Sample
tr-upd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tr-upd.exe
Resource
win10v2004-20230221-en
General
-
Target
tr-upd.zip
-
Size
279KB
-
MD5
6851cdc74cc7415314a6b9b20cdda631
-
SHA1
1579d0a614bf5cfcac711e05e10b85c79cde192b
-
SHA256
1dc3bae0da832002ce99c37c89593a7a3d20c81daae08a50f4a59f511ac558fc
-
SHA512
72354e1fe9528f606d7b842a4a1486f47d1121d2002fe4176c8e625593a370da9454068f9671c6eb791fa4ce75c65cad8d9644c97eadfbfa0670dd4b564cc3e1
-
SSDEEP
6144:wP9SPZWoR0+c7hRWAHv6JgSNHgjUGJt22rJSKnx5hQYWQvcG:0cPZ3R0+S0lJMFnfpWscG
Malware Config
Signatures
Files
-
tr-upd.zip.zip
Password: infected
-
tr-upd.exe.exe windows x86
f27db2668734c2eab042a60bf38eb940
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
user32
GetDC
advapi32
RegSetValueExA
Sections
Size: - Virtual size: 252KB
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 282KB - Virtual size: 282KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 95KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE