Behavioral task
behavioral1
Sample
驱动精灵 v9.2(绿色免安装版).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
驱动精灵 v9.2(绿色免安装版).exe
Resource
win10v2004-20230703-en
General
-
Target
驱动精灵 v9.2(绿色免安装版).exe
-
Size
10.7MB
-
MD5
165ba231f792a8398c2f81bf98017cc0
-
SHA1
f37677b42d8b19613061a3048001c0142d4cba3f
-
SHA256
10a7bf5ca331a1a980b8c0aa5df7171923af96acf7fd6d986d915f2eb864368d
-
SHA512
423d5e19be99527e574bdd6614d53f5a36693fc4d4c98e346c8620620218a263e05baaa5fb7ce6529ed5994053eda233d483f2a38b5e984be221d307fb7f4cb4
-
SSDEEP
196608:Svl5q1Cn1kq+lE53DkhmKN29Z47nFxl/qQSv0/MZfvFxdSGob3pi:aoCKq+GTqJcanFT/qQSwMZrdFr
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 驱动精灵 v9.2(绿色免安装版).exe unpack001/out.upx
Files
-
驱动精灵 v9.2(绿色免安装版).exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 532KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 290KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 296KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ