Behavioral task
behavioral1
Sample
LangChange.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LangChange.exe
Resource
win10v2004-20230220-en
General
-
Target
LangChange.exe
-
Size
190KB
-
MD5
fad7fd97259b6c3c123be32198a7488e
-
SHA1
c140d6f1c5f07e1aee888bf03e3e015104995978
-
SHA256
f6c78bef9b7f91a558bff9c70a53137bb98d3ced81f32fbae922c38b8ad144b0
-
SHA512
32460a87d042de701924a43e1612f147232d39cb539d115c1c520746bb27439b1a2994fddf27f7359746ff5eaf05c6aea50ed64eeccf6daf6fa5ee20fc8e7dcb
-
SSDEEP
3072:3gtTPFsw0xDoutcdOJ3+G/NTKTjyXGudzXzW7oPy9pi+CVqetBB:3gtJZ0xDoScUp+G/9KHyXG2XzE+y9U+8
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LangChange.exe
Files
-
LangChange.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 170KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE