Behavioral task
behavioral1
Sample
qwd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
qwd.exe
Resource
win10v2004-20230220-en
General
-
Target
qwd.exe
-
Size
28KB
-
MD5
6062b6931cb4fbe864d2a1953604db94
-
SHA1
26778d2862ff3f13b614f10c66987346423f6339
-
SHA256
c7a87592a9864379456a3b0f3c9b2241f77062f49210f1b146fbb83da3bd5a35
-
SHA512
b13ef1c7069e1c6d67bbad256fc7dc622d0d03d34b56db25571f287b4366637a8b04be2ec55124d2d65449193e68e49522556c10c0a5f3153f9168b119ebbcf6
-
SSDEEP
768:fRGuY2P0Vo6r7SiAwyrMRjbHEXKVYb/Lg6lrRpaXinbcuyD7Us:pPcVo6r7S/rabHEKqb/LXRpvnouy8s
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qwd.exe
Files
-
qwd.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE