Behavioral task
behavioral1
Sample
Stop Moodle.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Stop Moodle.exe
Resource
win10v2004-20230220-en
General
-
Target
Stop Moodle.exe
-
Size
15KB
-
MD5
c543148bc9395606c1360e2e20fe1293
-
SHA1
ff998f30423cc2403df9da6d07d5d2f1b50046cd
-
SHA256
4df51798055701a531d398244d7f01f647b5dfa9c677940603d15161d2a14501
-
SHA512
dffe3ff45e92c72ff10b2795e6f6ee9479b248a6b6438682c56bc49ca5d71bd7b46191a7869e636c4525b10ffbdb85976f585ee0e773d7a10840e93d6aa9a314
-
SSDEEP
192:mg1XHQsZ0/uAShblJNYnFaNJhLkwcud2DH9VwGfctQU1LV0pidqjj:muXHQssNSJlIFaNJawcudoD7UxdqX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Stop Moodle.exe
Files
-
Stop Moodle.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE