Behavioral task
behavioral1
Sample
icrco.exe
Resource
win10v2004-20230221-en
General
-
Target
icrco.exe.7z
-
Size
6KB
-
MD5
13f48b703927058d718f92387c5744a8
-
SHA1
22a5e454601b49f466b672dfe0bac6add85139f2
-
SHA256
fc10c684d05a9f356bdbb0f5fd4b85826c6fe1a533e44148b09b3f48cb57e910
-
SHA512
16ee038e2d78acb926680ebb3c20d317d8288d4dd356a30c470c28a67d9d48de3a887796f32b25a24a9934139944630300d01e9f045f789a00cd29187e067e85
-
SSDEEP
192:lfl+qTaOvQPkr7Cg2zSGMMLCZ3L5zZNw/zY:l/TaaOcwzRMMLC9L5nw/zY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/icrco.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/icrco.exe
Files
-
icrco.exe.7z.7z
Password: infected
-
icrco.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE