Behavioral task
behavioral1
Sample
f324202e981701dbe7996e3cc2baabbe5ab10b79be0eb9a9604e8a6081ab1ad9.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f324202e981701dbe7996e3cc2baabbe5ab10b79be0eb9a9604e8a6081ab1ad9.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20230221-en
General
-
Target
f324202e981701dbe7996e3cc2baabbe5ab10b79be0eb9a9604e8a6081ab1ad9.exe
-
Size
10.8MB
-
MD5
5d6592404cc8601d496279cade627f5b
-
SHA1
5c25a32a5ddfb1540bec23dcdad144b8888ed812
-
SHA256
f324202e981701dbe7996e3cc2baabbe5ab10b79be0eb9a9604e8a6081ab1ad9
-
SHA512
00c79a7f4a04e3ceb356f660155d9e8fea258447a721c6036d97930c5723adcc11b57cb1215da6aa8e6d7d3a506e5425bca2a1beced2b8f4a5295b0ed96cb67b
-
SSDEEP
196608:Db3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mT/grb3bPk5HyC8k5h/wDdEoNiV4I/WWp:Db3bPk5HPhJCTorb3bPk5HPhJCToX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource f324202e981701dbe7996e3cc2baabbe5ab10b79be0eb9a9604e8a6081ab1ad9.exe unpack001/out.upx
Files
-
f324202e981701dbe7996e3cc2baabbe5ab10b79be0eb9a9604e8a6081ab1ad9.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE