Behavioral task
behavioral1
Sample
226f3f79c5a7864abd1d5691e.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
226f3f79c5a7864abd1d5691e.exe
Resource
win10v2004-20230621-en
General
-
Target
226f3f79c5a7864abd1d5691e.exe
-
Size
1.0MB
-
MD5
226f3f79c5a7864abd1d5691ee3ad872
-
SHA1
c20876d6e5ce5f1e0f00910c704e99457ac83b6e
-
SHA256
31bf49ab44e656ebe71dc6ee428fc923aa66c51b5616ff174fe3a2b19db2f6e5
-
SHA512
a7d9dcdb0233923d0c1c7026cff4735202391497ecc3e0536da7b54a4c6501f2ffba481a809b3b3e0841294a05549f0bff856fa4bc9e23d3badb5c036695a9e1
-
SSDEEP
24576:3hloDX0XOf4lLZPs0smOReGh1kLbkZEFK0gmJBphnYf0sN:3hloJf6FFIek1kH2EFK0gsBDf
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 226f3f79c5a7864abd1d5691e.exe unpack001/out.upx
Files
-
226f3f79c5a7864abd1d5691e.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 338KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 695KB - Virtual size: 696KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 560KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 703KB - Virtual size: 702KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ