Behavioral task
behavioral1
Sample
305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
Resource
win10v2004-20230221-en
General
-
Target
305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83
-
Size
1.8MB
-
MD5
22e37a07e0e66715109a8aee71d6c21b
-
SHA1
ed85ea1ac4f54c3c1400e3741189f8b2c2e5309f
-
SHA256
305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83
-
SHA512
0a64b052a2d48132f52b25a8202e6a48aa936a8d7be991c76cdae0be178385ba5c202b569fa5e67e2489ff3279806dc1a65953bbd781101e9a7613344b096582
-
SSDEEP
49152:VSBeCTBg/nYFBE4Lwl7mCfpweTsYfOJBW+VPb:VuTkYFm4Lwl7mKmEskozPb
Malware Config
Signatures
-
Processes:
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83
Files
-
305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.1MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 25KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 673KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 94KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE