Behavioral task
behavioral1
Sample
70ba4356e750e3220f49aa7e12b252aa_hacktools_xiaoba_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
70ba4356e750e3220f49aa7e12b252aa_hacktools_xiaoba_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
70ba4356e750e3220f49aa7e12b252aa_hacktools_xiaoba_JC.exe
-
Size
1.8MB
-
MD5
70ba4356e750e3220f49aa7e12b252aa
-
SHA1
8e896164aa02126272387dbb3180d1e3b35eb047
-
SHA256
67a203d2c6c3f1926201c2510b2933550d0617854779711fa6e49db0a9c3596f
-
SHA512
1806bf430dc13692ea62179a50f5898b7517a55933b7ae65dc4300006752d975a27774069ab45fbf924abb14ff285e8bad2d5be7e38a35ebeed7e921106941d3
-
SSDEEP
49152:lQhvvf9cHookwV4RVgHHhP+Jd+R2EUzcNdbIVBFNTOcglz0Ch98hcVlD:lQRlcIBLyruc
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70ba4356e750e3220f49aa7e12b252aa_hacktools_xiaoba_JC.exe
Files
-
70ba4356e750e3220f49aa7e12b252aa_hacktools_xiaoba_JC.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE