Static task
static1
Behavioral task
behavioral1
Sample
up.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
up.exe
Resource
win10v2004-20230915-en
General
-
Target
up.exe
-
Size
238KB
-
MD5
405727175526045d312d425b05524675
-
SHA1
ab51583c05d3218e82e280f7e4f0600ca7efdf8c
-
SHA256
96c1a6d408fb1ad9c28920b9b5fd9a82e8d397fcf606e1aa3e5a601dcdeb57f2
-
SHA512
96d7fd5bff17925280f278743be91eb3190cd6d5b911f4e5648ae15a15c38dd9fd82786e018521245b43bc4e504626720171f729720a62dcbadaa1c2d555c93f
-
SSDEEP
6144:dDy1TEu4pz+7EBerfEnMXaHLpJuDy/kzEbP:9aTEu4pz+7EBegMXaFJuyiEbP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource up.exe
Files
-
up.exe.exe windows:5 windows x86
c9c404291feb37634ea9460be65f4b73
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
ws2_32
select
WSARecvFrom
FreeAddrInfoW
GetAddrInfoW
WSASocketW
WSASend
WSARecv
WSAStartup
WSADuplicateSocketW
socket
shutdown
listen
getsockname
ioctlsocket
bind
WSAGetLastError
setsockopt
getsockopt
closesocket
WSASetLastError
WSAIoctl
htonl
ntohs
ntohl
htons
kernel32
GetProcessHeap
GetFileSizeEx
HeapSize
GetFileType
GetConsoleMode
CloseHandle
GetLastError
SetErrorMode
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetHandleInformation
CancelIo
CreateEventA
RegisterWaitForSingleObject
UnregisterWait
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
DuplicateHandle
SetLastError
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
SwitchToThread
GetCurrentThread
QueueUserWorkItem
GetNamedPipeHandleStateA
CreateFileA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNumberOfConsoleInputEvents
ReadConsoleInputW
ReadConsoleW
WriteConsoleW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
Sleep
SetConsoleCtrlHandler
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
GetLongPathNameW
ReadDirectoryChangesW
LocalFree
FormatMessageA
SetEnvironmentVariableW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameW
DeleteCriticalSection
SetEvent
ResetEvent
DecodePointer
WaitForMultipleObjects
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleA
GetProcAddress
GetStdHandle
GetStartupInfoW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
RaiseException
GetCommandLineW
GetCommandLineA
ExitProcess
SetFilePointerEx
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
GetTimeZoneInformation
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
user32
MapVirtualKeyW
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ