Behavioral task
behavioral1
Sample
ghost32-12.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ghost32-12.exe
Resource
win10v2004-20230220-en
General
-
Target
ghost32-12.exe
-
Size
1.5MB
-
MD5
ed0991d6909a951f66e204e73b690e70
-
SHA1
b6c6ecd4059843781a4c49b6729b1506927e2ff5
-
SHA256
535b64e0aaba6e53d7ffa6a299cfcb8722f6431d7b34d52728a58c23628c1503
-
SHA512
cfcc4c4665bd4decb0f78bf6fcc2925f3706efcdb6d21455bea2ff16e06f840709a23f7786f592d29cfaba36e9aaa0c89cd20c8dd3145ae1d0fba7ded1c0b08a
-
SSDEEP
49152:Sh44nPaEueW5tqFGv32HUJ+jz5Eddt/ZOsJOc3fnQeAMtBTy:4BnPaEnWaof2nH5EdH/ou5QeAWY
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ghost32-12.exe
Files
-
ghost32-12.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE