Behavioral task
behavioral1
Sample
ba55c9d50594f0c458a37919e5e60090_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ba55c9d50594f0c458a37919e5e60090_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
ba55c9d50594f0c458a37919e5e60090_exe32.exe
-
Size
112KB
-
MD5
ba55c9d50594f0c458a37919e5e60090
-
SHA1
cd3cc1bc004983ffc36083a38b7129706b2a845a
-
SHA256
9cfc793c882c6e8520fef6d2fd43b8d50afb29a81019af72f161886aa6195b7e
-
SHA512
b34c2847bfdd4a0afe86ccf6a44b3018f187972b554cb7ca435e4ba3be076d1f22dba8f21f2b8ed64c768102d0fa44673b947c739a7f3d9090b528ae46f97c2c
-
SSDEEP
384:2pZVJZwlrRVHQ3bXykJBqhz9QhtGSdY5ijz5ieVJZwlrRVeTpFE4ROh3Od1qTnI:aDw1RFtrJ9Qhtn5H5RDw1RUTPEPh3O2
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba55c9d50594f0c458a37919e5e60090_exe32.exe
Files
-
ba55c9d50594f0c458a37919e5e60090_exe32.exe.exe windows:4 windows x86
d028ed91d908ca3f4bdbbbb8a346d246
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapAlloc
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTickCount
TlsGetValue
CopyFileA
WriteFile
HeapFree
CreateFileA
SetFilePointer
GetFileSize
ReadFile
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsFree
GetLastError
SetLastError
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore
msvcrt
memset
strcmp
memmove
memcpy
strncpy
strlen
Sections
UPX0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE