Behavioral task
behavioral1
Sample
d05edaf8b49c198923d2ccbbd7fc647e11577105395e7162a0f49e5eabd2c7e7.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d05edaf8b49c198923d2ccbbd7fc647e11577105395e7162a0f49e5eabd2c7e7.exe
Resource
win10v2004-20230703-en
General
-
Target
d05edaf8b49c198923d2ccbbd7fc647e11577105395e7162a0f49e5eabd2c7e7
-
Size
350KB
-
MD5
ccc9ae201d09c2bac158551d3602d3ff
-
SHA1
21f3592e31bf1451e00403924b084c481fd9cba0
-
SHA256
d05edaf8b49c198923d2ccbbd7fc647e11577105395e7162a0f49e5eabd2c7e7
-
SHA512
1a90dc469bda568a2af6adced1b2a2e1da8a5aea73ce581d6b23fe30ce68bd7e3aa63c23071215790b280b0e7c65ef3ed977ba94bb04147aa62b96270c9935da
-
SSDEEP
6144:1XjSl8hdW6Ka+2ENaYcaULerf5bM17s7pVAEQJGKGV2o9+K:RSCrW6KalD6meru1WSEQQK09+K
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource d05edaf8b49c198923d2ccbbd7fc647e11577105395e7162a0f49e5eabd2c7e7 unpack001/out.upx
Files
-
d05edaf8b49c198923d2ccbbd7fc647e11577105395e7162a0f49e5eabd2c7e7.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 806KB - Virtual size: 805KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ