Behavioral task
behavioral1
Sample
a5a02b9c6204747b5f9ce08be7274b3f7aa3d9eb1b13221145c7bce79bbc1eb8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a5a02b9c6204747b5f9ce08be7274b3f7aa3d9eb1b13221145c7bce79bbc1eb8.exe
Resource
win10v2004-20230220-en
General
-
Target
22d6d0b5440b9f57505b247df551ebd6.bin
-
Size
466KB
-
MD5
9ebf66c57f1f40c36e61eb01cb8a0004
-
SHA1
bf7fd3d547d04dbe9c8bbc9c2a05bb2b19cb9f32
-
SHA256
061ed8cd65bc8627783c9f42d41852cf732538c3c69c7cc33767558c88e6a636
-
SHA512
7483ba024c7a9fb6a63945cc6ef4fb945a67aad9f921d44c302ea6bd5fc7815d505b0551813a869a926df1d720444de56679ac8173c0aa4a90302924031cbc3c
-
SSDEEP
12288:TfJu18hV59cZbf1QhVvmxFc/4N//fXWABOAXhJJknFj1oWEFryD:zg109cuvmxFcQOAxPYFNQrs
Malware Config
Signatures
-
resource yara_rule static1/unpack001/a5a02b9c6204747b5f9ce08be7274b3f7aa3d9eb1b13221145c7bce79bbc1eb8.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/a5a02b9c6204747b5f9ce08be7274b3f7aa3d9eb1b13221145c7bce79bbc1eb8.exe unpack002/out.upx
Files
-
22d6d0b5440b9f57505b247df551ebd6.bin.zip
Password: infected
-
a5a02b9c6204747b5f9ce08be7274b3f7aa3d9eb1b13221145c7bce79bbc1eb8.exe.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 456KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 516KB - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 914KB - Virtual size: 913KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ