Behavioral task
behavioral1
Sample
CIH.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
CIH.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20230703-en
General
-
Target
CIH (Win32).zip
-
Size
23KB
-
MD5
859975bdd4fdc8f4af050dc0ded34160
-
SHA1
d24c5b1c18be9bed4e18d8ad00cc8fe1a6d7d19c
-
SHA256
445cab9732a748e0d983339d925d9bf8907dd530a300d2d86e86a2df6f1f8749
-
SHA512
ecda0cc9c62b590cfa91d5c5b814d3d413a8de5ab84db117a6ae7bba0d237f37895f78f6eface71121e9e3691183412060a5369024432202a7cf2e79451864b8
-
SSDEEP
384:CUxnYdp8XH3LXvRdjwbchGVhAjmTGP0u2vHOhAV+3YtenuY50bnXFTpCqjPnmtB4:ysHLjwbsGVejGGcu2vuKVgYMparXF1CS
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CIH.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CIH.exe unpack002/out.upx
Files
-
CIH (Win32).zip.zip
-
CIH.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ