Behavioral task
behavioral1
Sample
0a1314b4759a1d548a36e6129d67d428a1c1ff651f13c41c418c29b1e636fdd6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0a1314b4759a1d548a36e6129d67d428a1c1ff651f13c41c418c29b1e636fdd6.exe
Resource
win10v2004-20230220-en
General
-
Target
0a1314b4759a1d548a36e6129d67d428a1c1ff651f13c41c418c29b1e636fdd6
-
Size
964KB
-
MD5
5bf3b4f89323a0d7e3e7319a21066d15
-
SHA1
ef61c19e86892914c29cdbb3df848edb8c833601
-
SHA256
0a1314b4759a1d548a36e6129d67d428a1c1ff651f13c41c418c29b1e636fdd6
-
SHA512
5a8c0b062f762f511051b8da3766efe19b29224f27d51bfa744571aaaa697b952008ed68fb52a8c0b3567d2427abeae44b17db91927d93f08b9ae071c185c762
-
SSDEEP
24576:DX0hD34ShYVRyg06qB1HgZYI90AdZb+k221DYO:DEcShYV906qBZgZYIqAdZbo8D
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0a1314b4759a1d548a36e6129d67d428a1c1ff651f13c41c418c29b1e636fdd6 unpack001/out.upx
Files
-
0a1314b4759a1d548a36e6129d67d428a1c1ff651f13c41c418c29b1e636fdd6.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 592KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 834KB - Virtual size: 836KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 557KB - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 573KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ