Behavioral task
behavioral1
Sample
0a3cf7bf554b4caffe881c1ffab33735b841adad4d772c8e831589e9da5c83f5.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0a3cf7bf554b4caffe881c1ffab33735b841adad4d772c8e831589e9da5c83f5.exe
Resource
win10v2004-20230915-en
General
-
Target
0a3cf7bf554b4caffe881c1ffab33735b841adad4d772c8e831589e9da5c83f5
-
Size
2.7MB
-
MD5
00d6611dd12ab9160c00e9e69276dec0
-
SHA1
4deb0b77efe29276714466ae3988dec6bf5b9089
-
SHA256
0a3cf7bf554b4caffe881c1ffab33735b841adad4d772c8e831589e9da5c83f5
-
SHA512
6162663841a2959b5d2f42b03221f58214653cc2359ffdbcdde2dd0d52e952392d4d002d2dbdcf2a95ebd4e4d5e773441115b082e4b9744c37625eb6d2fbe5e8
-
SSDEEP
49152:2R4Wb5ZR4L7JUTaVVJleLbtDvdPlmGz0CkLs4JpYhM:2KWb5ZuvJUKULRDvFU60DLsPM
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a3cf7bf554b4caffe881c1ffab33735b841adad4d772c8e831589e9da5c83f5
Files
-
0a3cf7bf554b4caffe881c1ffab33735b841adad4d772c8e831589e9da5c83f5.exe windows:4 windows x86
ca3950358a69e682f15d37f6466749cc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutUnprepareHeader
ws2_32
WSAAsyncSelect
kernel32
CreateSemaphoreA
user32
GetDlgItem
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
oleaut32
SafeArrayAccessData
comctl32
ImageList_GetImageCount
wininet
InternetCanonicalizeUrlA
wldap32
ord29
comdlg32
ChooseColorA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.6MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ