Behavioral task
behavioral1
Sample
b17ca81eac2594e1ce33efc45e0f6a8117fb9a0c98c5e0741debf964fcddc084.exe
Resource
win7-20230220-en
General
-
Target
b17ca81eac2594e1ce33efc45e0f6a8117fb9a0c98c5e0741debf964fcddc084
-
Size
10.2MB
-
MD5
f34e22004ed3dae5fc902d560a3ee19b
-
SHA1
8a78b215eac97d73bb5d117885c2eed5534918eb
-
SHA256
b17ca81eac2594e1ce33efc45e0f6a8117fb9a0c98c5e0741debf964fcddc084
-
SHA512
d524048f7e069b38c190dffe2f205a66b0a844351bd55d43cbad2be17dad4bba4f2f097dd261a7ee9b3b989cc0375822665ffadbe229253bb66b0fad6cd01303
-
SSDEEP
196608:bVUjpvzq/L/77s/JlhIEItPVmELSSt7ozen1B2isfci2qpITUFejhX7Yns7c:bWjRYU/UtPVZ1tozE1B21fFL/sg
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource b17ca81eac2594e1ce33efc45e0f6a8117fb9a0c98c5e0741debf964fcddc084 unpack001/out.upx
Files
-
b17ca81eac2594e1ce33efc45e0f6a8117fb9a0c98c5e0741debf964fcddc084.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ