Behavioral task
behavioral1
Sample
Rws.exe
Resource
win7-20230220-en
General
-
Target
Rws.exe
-
Size
22KB
-
MD5
87c7c7c608078e2c4f79474b96f3b74e
-
SHA1
9e552f769c41b86b1746f5ca3feea73f6ab8e799
-
SHA256
c68f26080f0832af849ebccf2df043d75c527859ff5003713f6963633d64ce12
-
SHA512
91e6f7fa52e1d388157b849dac10e0bd270ca11f1eb6a3410ababd2e7a5b8863a305085e92553b7190d387eab13fa4c94f2811c92ff95d0ab38c8fc7c0f89b48
-
SSDEEP
384:GQkZbV8i+fIZFQyZpz0q7bYKkxRjK36ct14yvXbB75zWNY0THj9aNJawcudoD7Ua:VGcAPQIpz0Mb18Kdt14yvLhlZ0LsnbcT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Rws.exe
Files
-
Rws.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE