Behavioral task
behavioral1
Sample
d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe
Resource
win10v2004-20230915-en
General
-
Target
d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe.zip
-
Size
515KB
-
MD5
c948d499a6dc38510b60809d3b60ca92
-
SHA1
97be87d1c10c82664da2313c7f77beb09fef8c82
-
SHA256
8f8da807fbe535577302cddc6f4bbdf15c23baa725099e677701728e8565961e
-
SHA512
8be745ea245e82159e64d09843c3c96d568b76f086a0a9aac57711d6b6c16a167b1c3fe6be56d5ef2ac45dd0c87fe40b0e4dc0341f4d25fdac637d3911c4d032
-
SSDEEP
12288:FX5kkmshwOQlg+F7nwDLkf6C/7Bx3vaCQkv:FCQQlRnPfr/7fyCQkv
Malware Config
Signatures
-
resource yara_rule static1/unpack001/d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe unpack002/out.upx
Files
-
d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe.zip.zip
Password: infected
-
d3ffbd03c0a0cbdf4e5053e7f2edea5b3600d2ad64a5e74e3c2eda9f204bf4fd.exe.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 513KB - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 478KB - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ