Behavioral task
behavioral1
Sample
Device/HarddiskVolume5/$RECYCLE.BIN/S-1-5-21-1159581898-2029943322-2268025737-1451/$R1V677Q/AppData/.exe
Resource
win7-20230712-en
General
-
Target
3.4.2_39710.exe
-
Size
1.3MB
-
MD5
46afbbd7727621906366f2a304a15141
-
SHA1
ef9b05002d7a03ec5b764b24e6bd32bf9fea5816
-
SHA256
d23649eb03fa7578a579713dc8d90b7e59192ce5512a4ac7b03fca68538c6cdd
-
SHA512
630f432a000673532786caf68bee59d1b44375865a8ced4c94c3913c909989b8b8e15c950f96c38e5e01c9f68209d3704164df12cf930523ac22da4b3b8c2e71
-
SSDEEP
24576:eSridDTCUHFHlH8n+9Twez4/dkKkyrzWD+8gSznOvqNHXB5LD4VO0tny6:eBD1v8+ieM1kKxrzWdgSrOSNRxD4k0ND
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Device/HarddiskVolume5/$RECYCLE.BIN/S-1-5-21-1159581898-2029943322-2268025737-1451/$R1V677Q/AppData/Roaming/uTorrent/updates/3.4.2_39710.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume5/$RECYCLE.BIN/S-1-5-21-1159581898-2029943322-2268025737-1451/$R1V677Q/AppData/Roaming/uTorrent/updates/3.4.2_39710.exe
Files
-
3.4.2_39710.exe.zip
Password: S@ndb0x!2023@@
-
Device/HarddiskVolume5/$RECYCLE.BIN/S-1-5-21-1159581898-2029943322-2268025737-1451/$R1V677Q/AppData/Roaming/uTorrent/updates/3.4.2_39710.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 122KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
manifest.json