Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp
-
Size
12.2MB
-
MD5
1f175ba162cc415dc0bef233b5b41ff4
-
SHA1
a2f55c5b155fe067e74fbbc4ae8c5f869d455df2
-
SHA256
3a7c5d96b8bc4cc967455d0285f85dcca94c3a29d5c94589471dc75bfec120c9
-
SHA512
ebcf6864b92a02bc6c7c039ee32673f7da16d262aadd14b158bffc661c09a45ca4ec4a93a18e1f6e27718fdeae3c7a24906db40bbf2e282d2ea51489c9901375
-
SSDEEP
196608:G9tjMI+N7N+84ja44HKDQBKkXy+XWt815j5tDobSUFQjYYG17qQMXLLsnw:ej8obja4aK0BK+Hvj5t0ZFQLQMcw
Malware Config
Signatures
-
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource tmp
Files
-
tmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 15.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 52KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE