Behavioral task
behavioral1
Sample
b0f34f1931a406a006842f36c4d802156d370893e3b3f18432a912924e566daa.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b0f34f1931a406a006842f36c4d802156d370893e3b3f18432a912924e566daa.exe
Resource
win10v2004-20230703-en
General
-
Target
b0f34f1931a406a006842f36c4d802156d370893e3b3f18432a912924e566daa
-
Size
720KB
-
MD5
f313dabd1c36830f3be8d334b0765d22
-
SHA1
d807129ccf5bccc148d643d60acbc4f8906c7080
-
SHA256
b0f34f1931a406a006842f36c4d802156d370893e3b3f18432a912924e566daa
-
SHA512
b2ecd7de676d1dc059bd4fa8b37de2a087c341ac4bb3125928faf33dd86908db9b98e95f0d8bb89d3ea947602d0ed65972ea0fc3b249cf451e2f46a85de8cece
-
SSDEEP
768:ioIrauU08X205FILiesbGIIFSFJ6I/BGBHV7VVV67VVVnVVV8VVVzHVe47rAVV0S:4IwihbfIFSL6wBGQuu5
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0f34f1931a406a006842f36c4d802156d370893e3b3f18432a912924e566daa
Files
-
b0f34f1931a406a006842f36c4d802156d370893e3b3f18432a912924e566daa.exe windows x86
c473e8bd793878d38d2dd22495b595db
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
IsBadStringPtrA
OpenProcess
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WaitForSingleObject
CreateProcessA
GetStartupInfoA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
msvcrt
memmove
atoi
_ftol
sprintf
_CIpow
strchr
free
malloc
modf
__CxxFrameHandler
??3@YAXPAX@Z
strncmp
psapi
GetProcessMemoryInfo
user32
wsprintfA
MessageBoxA
Sections
UPX0 Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE