Behavioral task
behavioral1
Sample
4e7695ef513128da530848227bcd7782e0e043d08d480a42f6b780d8b5e26c1b.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4e7695ef513128da530848227bcd7782e0e043d08d480a42f6b780d8b5e26c1b.exe
Resource
win10v2004-20230703-en
General
-
Target
4e7695ef513128da530848227bcd7782e0e043d08d480a42f6b780d8b5e26c1b
-
Size
518KB
-
MD5
3130fab4c7683f6c1cba399f0002d0da
-
SHA1
a3a261a5e0289633140ae9b01b14db34c24593ce
-
SHA256
4e7695ef513128da530848227bcd7782e0e043d08d480a42f6b780d8b5e26c1b
-
SHA512
e1fc5282389f62f530472510e244977cd0f988d4a69def8e8649b9ba9e0e3c2137523677592f59bf20b95a528dcf66f77200ed13dbe2fd300b05c7f00b8f64d4
-
SSDEEP
12288:yRSHswnyd1qXs3+r1dodq/a5wyo03ARm9IbXmTyTao3pHZVDu1:yRSMwnG3+r3b/a734wIbNaCpZA1
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
4e7695ef513128da530848227bcd7782e0e043d08d480a42f6b780d8b5e26c1b.exe windows x86
Code Sign
0c:b5:11:e4:d2:b2:e7:7d:b9:39:3c:36:17:93:a0:8fCertificate
IssuerCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6dNot Before18/12/2022, 05:25Not After30/12/2099, 16:00SubjectCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6d0c:b5:11:e4:d2:b2:e7:7d:b9:39:3c:36:17:93:a0:8fCertificate
IssuerCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6dNot Before18/12/2022, 05:25Not After30/12/2099, 16:00SubjectCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6d9a:13:18:9e:22:c7:95:d6:19:de:a1:29:4b:d7:8b:87:cc:0e:73:5a:4d:07:27:7f:28:60:5c:c0:d7:82:ae:4dSigner
Actual PE Digest9a:13:18:9e:22:c7:95:d6:19:de:a1:29:4b:d7:8b:87:cc:0e:73:5a:4d:07:27:7f:28:60:5c:c0:d7:82:ae:4dDigest Algorithmsha256PE Digest Matchestrue85:3c:22:8c:1f:2e:6c:97:52:cd:b8:2d:e0:74:8d:4e:89:a9:e9:1cSigner
Actual PE Digest85:3c:22:8c:1f:2e:6c:97:52:cd:b8:2d:e0:74:8d:4e:89:a9:e9:1cDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 680KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 492KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 708KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 323KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ