Behavioral task
behavioral1
Sample
e61bd97b4d25bbb951be0ccbd9491378565ab68b3498156e60ce2b3242857a63.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
e61bd97b4d25bbb951be0ccbd9491378565ab68b3498156e60ce2b3242857a63.exe
Resource
win10v2004-20231023-en
General
-
Target
e61bd97b4d25bbb951be0ccbd9491378565ab68b3498156e60ce2b3242857a63.exe.zip
-
Size
1.2MB
-
MD5
0c20bb0248c23fa75acc8e717808299e
-
SHA1
84a229db52a52d3c401b90da2fa5bb1d6806fe08
-
SHA256
03ac2f08f3a8f993ba3586e0029bd60a8b4cda0436a5e5aa60e07473f08348d7
-
SHA512
1715db6e05ba2f5e985c37fa61bd354d8bfe206cb170baff35718080dfbb3f5529ef1e13d8575f00b455bd08e108d4fb38a85ebf241cab558dda61318d6b6ae8
-
SSDEEP
24576:gCVuf9ZSJ1jMeHd1d0dvMZU7893yWS5IAsJ1crEITK:gVfXIjz91WTAYW2IFoEITK
Malware Config
Signatures
-
resource yara_rule static1/unpack001/e61bd97b4d25bbb951be0ccbd9491378565ab68b3498156e60ce2b3242857a63.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
Files
-
e61bd97b4d25bbb951be0ccbd9491378565ab68b3498156e60ce2b3242857a63.exe.zip.zip
Password: infected
-
e61bd97b4d25bbb951be0ccbd9491378565ab68b3498156e60ce2b3242857a63.exe.exe windows:4 windows x86
Code Sign
e8:64:7b:6e:3b:1f:92:4a:b6:6f:8e:0a:b0:bd:03Certificate
IssuerCN=RwEverythingNot Before29/04/2010, 08:39Not After31/12/2039, 23:59SubjectCN=RwEverything07:d0:59:a9:7a:6e:ce:17:96:d6:f2:e9:7d:d4:e7:83:dd:67:82:21Signer
Actual PE Digest07:d0:59:a9:7a:6e:ce:17:96:d6:f2:e9:7d:d4:e7:83:dd:67:82:21Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
@$xp$11TRichEditEx
@$xp$11TRwTextGrid
@$xp$13TLabelHexEdit
@$xp$7TRwGrid
@$xp$8TBitEdit
@$xp$8TBitGrid
@$xp$8THexEdit
@$xp$8TMsrGrid
@$xp$9TByteGrid
@$xp$9TGraphBtn
@@Acpidump@Finalize
@@Acpidump@Initialize
@@Am2pciadd@Finalize
@@Am2pciadd@Initialize
@@Ataatapi@Finalize
@@Ataatapi@Initialize
@@Bck@Finalize
@@Bck@Initialize
@@Bckbase@Finalize
@@Bckbase@Initialize
@@Bitedit@Finalize
@@Bitedit@Initialize
@@Bitgrid@Finalize
@@Bitgrid@Initialize
@@Bytegrid@Finalize
@@Bytegrid@Initialize
@@Clockgen@Finalize
@@Clockgen@Initialize
@@Cmos@Finalize
@@Cmos@Initialize
@@Command@Finalize
@@Command@Initialize
@@Comreadwrite@Finalize
@@Comreadwrite@Initialize
@@Comthread@Finalize
@@Comthread@Initialize
@@Console@Finalize
@@Console@Initialize
@@Cpu@Finalize
@@Cpu@Initialize
@@Cpumsr@Finalize
@@Cpumsr@Initialize
@@Cpumsrdlg@Finalize
@@Cpumsrdlg@Initialize
@@Cpumsrsummary@Finalize
@@Cpumsrsummary@Initialize
@@Debugconsole@Finalize
@@Debugconsole@Initialize
@@Dimmspd@Finalize
@@Dimmspd@Initialize
@@Disk@Finalize
@@Disk@Initialize
@@Diskdlg@Finalize
@@Diskdlg@Initialize
@@E820@Finalize
@@E820@Initialize
@@Ecram@Finalize
@@Ecram@Initialize
@@Edid@Finalize
@@Edid@Initialize
@@Enterconfigdlg@Finalize
@@Enterconfigdlg@Initialize
@@Find@Finalize
@@Find@Initialize
@@Gpiobase@Finalize
@@Gpiobase@Initialize
@@Graphbtn@Finalize
@@Graphbtn@Initialize
@@Hdav@Finalize
@@Hdav@Initialize
@@Hexedit@Finalize
@@Hexedit@Initialize
@@Hudsongpio@Finalize
@@Hudsongpio@Initialize
@@Ichgpio@Finalize
@@Ichgpio@Initialize
@@Ioindexdata@Finalize
@@Ioindexdata@Initialize
@@Ioindexdatadlg@Finalize
@@Ioindexdatadlg@Initialize
@@Iospace@Finalize
@@Iospace@Initialize
@@Iospacedlg@Finalize
@@Iospacedlg@Initialize
@@It8720@Finalize
@@It8720@Initialize
@@It8720gpio@Finalize
@@It8720gpio@Initialize
@@Labelhexedit@Finalize
@@Labelhexedit@Initialize
@@Memory@Finalize
@@Memory@Initialize
@@Memorydlg@Finalize
@@Memorydlg@Initialize
@@Memoryindexdata@Finalize
@@Memoryindexdata@Initialize
@@Memoryindexdatadlg@Finalize
@@Memoryindexdatadlg@Initialize
@@Mps@Finalize
@@Mps@Initialize
@@Msrgrid@Finalize
@@Msrgrid@Initialize
@@N5573@Finalize
@@N5573@Initialize
@@N5573gpio@Finalize
@@N5573gpio@Initialize
@@N5577@Finalize
@@N5577@Initialize
@@N5577gpio@Finalize
@@N5577gpio@Initialize
@@N6771@Finalize
@@N6771@Initialize
@@N6771gpio@Finalize
@@N6771gpio@Initialize
@@N6776@Finalize
@@N6776@Initialize
@@N6776gpio@Finalize
@@N6776gpio@Initialize
@@Netdev@Finalize
@@Netdev@Initialize
@@Nvgpio@Finalize
@@Nvgpio@Initialize
@@Optionrom@Finalize
@@Optionrom@Initialize
@@Pci@Finalize
@@Pci@Initialize
@@Pciindexdata@Finalize
@@Pciindexdata@Initialize
@@Pciindexdatadlg@Finalize
@@Pciindexdatadlg@Initialize
@@Pciressummary@Finalize
@@Pciressummary@Initialize
@@Pcitree@Finalize
@@Pcitree@Initialize
@@Privilege@Finalize
@@Privilege@Initialize
@@Readwrite@Finalize
@@Readwrite@Initialize
@@Remotemonitor@Finalize
@@Remotemonitor@Initialize
@@Remoteoptiondlg@Finalize
@@Remoteoptiondlg@Initialize
@@Richeditex@Finalize
@@Richeditex@Initialize
@@Rwdwordedit@Finalize
@@Rwdwordedit@Initialize
@@Rwedit@Finalize
@@Rwedit@Initialize
@@Rwform@Finalize
@@Rwform@Initialize
@@Rwgrid@Finalize
@@Rwgrid@Initialize
@@Rwpara@Finalize
@@Rwpara@Initialize
@@Rwtextgrid@Finalize
@@Rwtextgrid@Initialize
@@Rwunit@Finalize
@@Rwunit@Initialize
@@Smbdev@Finalize
@@Smbdev@Initialize
@@Smbios@Finalize
@@Smbios@Initialize
@@Smbiosbase@Finalize
@@Smbiosbase@Initialize
@@Startup@Finalize
@@Startup@Initialize
@@Superio@Finalize
@@Superio@Initialize
@@Timersetting@Finalize
@@Timersetting@Initialize
@@Usbinfo@Finalize
@@Usbinfo@Initialize
@@W627@Finalize
@@W627@Initialize
@@W627gpio@Finalize
@@W627gpio@Initialize
@@W667@Finalize
@@W667@Initialize
@@W667gpio@Finalize
@@W667gpio@Initialize
@Bitedit@Register$qqrv
@Bitgrid@Register$qqrv
@Bytegrid@Register$qqrv
@Graphbtn@Register$qqrv
@Hexedit@Register$qqrv
@Labelhexedit@Register$qqrv
@Msrgrid@Register$qqrv
@Richeditex@Register$qqrv
@Rwgrid@Register$qqrv
@Rwtextgrid@Register$qqrv
@TBitEdit@
@TBitEdit@$bctr$qqrp18Classes@TComponent
@TBitEdit@Notification$qqrp18Classes@TComponent18Classes@TOperation
@TBitEdit@SetBounds$qqriiii
@TBitEdit@SetParent$qqrp20Controls@TWinControl
@TBitEdit@SetStyle$qqrx13TBitGridStyle
@TBitEdit@SetValue$qqrl
@TBitEdit@UpdateValue$qqrl
@TBitEdit@UpdateValueToBitGrid$qqrl
@TBitGrid@
@TBitGrid@$bctr$qqrp18Classes@TComponent
@TBitGrid@DblClick$qqrv
@TBitGrid@DrawCell$qqriirx11Types@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$5%
@TBitGrid@InitBitField$qqrv
@TBitGrid@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%
@TBitGrid@KeyPress$qqrrb
@TBitGrid@SetBitOffset$qqri
@TBitGrid@SetStyle$qqrx13TBitGridStyle
@TBitGrid@SetValue$qqrl
@TBitGrid@UpdateValue$qqrl
@TByteGrid@
@TByteGrid@$bctr$qqrp18Classes@TComponent
@TByteGrid@CanEditAcceptKey$qqrb
@TByteGrid@CreateEditor$qqrv
@TByteGrid@DoEnter$qqrv
@TByteGrid@DrawCell$qqriirx11Types@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$5%
@TByteGrid@GetEditMask$qqrii
@TByteGrid@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%
@TByteGrid@SetEditText$qqriix20System@UnicodeString
@TByteGrid@SetStyle$qqrx14TByteGridStyle
@TByteGrid@SetValue$qqrl
@TByteGrid@UpdateValue$qqrl
@TGraphBtn@
@TGraphBtn@$bctr$qqrp18Classes@TComponent
@TGraphBtn@SetBounds$qqriiii
@TGraphBtn@SetImageIndex$qqrxi
@THexEdit@
@THexEdit@$bctr$qqrp18Classes@TComponent
@THexEdit@CreateParams$qqrr22Controls@TCreateParams
@THexEdit@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%
@THexEdit@KeyPress$qqrrb
@THexEdit@SetAlignment$qqr18Classes@TAlignment
@TLabelHexEdit@
@TLabelHexEdit@$bctr$qqrp18Classes@TComponent
@TLabelHexEdit@CMBiDiModeChanged$qqrr17Messages@TMessage
@TLabelHexEdit@CMEnabledChanged$qqrr17Messages@TMessage
@TLabelHexEdit@CMVisibleChanged$qqrr17Messages@TMessage
@TLabelHexEdit@CreateParams$qqrr22Controls@TCreateParams
@TLabelHexEdit@Dispatch$qqrpv
@TLabelHexEdit@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%
@TLabelHexEdit@KeyPress$qqrrb
@TLabelHexEdit@Notification$qqrp18Classes@TComponent18Classes@TOperation
@TLabelHexEdit@SetAlignment$qqr18Classes@TAlignment
@TLabelHexEdit@SetBounds$qqriiii
@TLabelHexEdit@SetLabelPosition$qqrx23Extctrls@TLabelPosition
@TLabelHexEdit@SetLabelSpacing$qqrxi
@TLabelHexEdit@SetName$qqrx20System@UnicodeString
@TLabelHexEdit@SetParent$qqrp20Controls@TWinControl
@TMsrGrid@
@TMsrGrid@$bctr$qqrp18Classes@TComponent
@TMsrGrid@$bdtr$qqrv
@TMsrGrid@DrawCell$qqriirx11Types@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$5%
@TRichEditEx@
@TRichEditEx@$bctr$qqrp18Classes@TComponent
@TRwGrid@
@TRwGrid@$bctr$qqrp18Classes@TComponent
@TRwGrid@CanEditAcceptKey$qqrb
@TRwGrid@CreateEditor$qqrv
@TRwGrid@DblClick$qqrv
@TRwGrid@DrawCell$qqriirx11Types@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$5%
@TRwGrid@GetDataOffset$qqrii
@TRwGrid@GetEditMask$qqrii
@TRwGrid@GridDataToCells$qqrv
@TRwGrid@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%
@TRwGrid@KeyUp$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%
@TRwGrid@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii
@TRwGrid@RefreshRwGrid$qqrv
@TRwGrid@RwGridTimerExpired$qqrp14System@TObject
@TRwGrid@RwGridWrite$qqrp14System@TObjectiul
@TRwGrid@SetEditText$qqrii20System@UnicodeString
@TRwGrid@SetStyle$qqrx12TRwGridStyle
@TRwGrid@UpdateIndexColumn$qqrv
@TRwGrid@UpdateIndicator$qqrv
@TRwTextGrid@
@TRwTextGrid@$bctr$qqrp18Classes@TComponent
@TRwTextGrid@DrawCell$qqriirx11Types@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$5%
@TRwTextGrid@RefreshRwTextGrid$qqrpc
_AboutBox
_AcpiDumpForm
_AtaAtapiForm
_BckForm
_ClockGenForm
_CommandForm
_CpuMsrDlgForm
_CpuMsrForm
_DimmSpdForm
_DiskDlgForm
_DiskForm
_E820Form
_EcRamForm
_EdidForm
_EnterConfigDlgForm
_FindForm
_IoIndexDataDlgForm
_IoIndexDataForm
_IoSpaceDlgForm
_IoSpaceForm
_MemoryDlgForm
_MemoryForm
_MemoryIndexDataDlgForm
_MemoryIndexDataForm
_MpsForm
_MsrSummaryForm
_OptionRomForm
_PciForm
_PciIndexDataDlgForm
_PciIndexDataForm
_PciResSummaryForm
_PciTreeForm
_RemoteMonitorForm
_RemoteOptionDlgForm
_RwDwordEditForm
_RwEditForm
_RwMain
_SmbDevForm
_SmbiosForm
_StartUpForm
_SuperIoForm
_TimerSettingForm
_UsbInfoForm
__GetExceptDLLinfo
___CPPdebugHook
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 903KB - Virtual size: 960KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 744KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 181KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ