Behavioral task
behavioral1
Sample
5b58db74fad266f9634996918ec9984bae135aa961dcb952a13de1544debd730.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
5b58db74fad266f9634996918ec9984bae135aa961dcb952a13de1544debd730.exe
Resource
win10v2004-20231023-en
General
-
Target
5b58db74fad266f9634996918ec9984bae135aa961dcb952a13de1544debd730
-
Size
60KB
-
MD5
b2a179ef3ff09edd8879c3e05180dac9
-
SHA1
f94bb4391f79254242908b86b20cad39817c20df
-
SHA256
5b58db74fad266f9634996918ec9984bae135aa961dcb952a13de1544debd730
-
SHA512
1ced673bbfaafd5aeec97b498f0a914cb40ce5bbfccf5f9be8424c17c4ec85784d137bcc901bdb9e633195d3531f6d75a165cb396caaa82624c719c794cf173d
-
SSDEEP
1536:G+uX0d5+zuSMH61tFHGaW/HM9qjSeK36nZeR:g0L+ySUmJ9qjSeK36no
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b58db74fad266f9634996918ec9984bae135aa961dcb952a13de1544debd730
Files
-
5b58db74fad266f9634996918ec9984bae135aa961dcb952a13de1544debd730.exe windows:4 windows x86
1eb4f3d468f70e5062588cab263d5453
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
GetLengthSid
gdi32
GetObjectA
kernel32
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
mfc42
ord6055
msvcrt
exit
shell32
ShellExecuteA
user32
GetDC
ws2_32
WSACleanup
Sections
UPX0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX13pB Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ