Behavioral task
behavioral1
Sample
ab65a12972e7c47c5a24a4fd672edd90837bacd34dfedc2b48b2c7efe2bf559c.exe
Resource
win7-20231020-en
General
-
Target
ab65a12972e7c47c5a24a4fd672edd90837bacd34dfedc2b48b2c7efe2bf559c
-
Size
15.9MB
-
MD5
eb9a4e9d4fa9e1a3a6321bec6ef4ac13
-
SHA1
4bcd35030a4910d0c358054fb960729ec14c9fa3
-
SHA256
ab65a12972e7c47c5a24a4fd672edd90837bacd34dfedc2b48b2c7efe2bf559c
-
SHA512
51c13d19d1f4be8ae4619d4fe7648a899aae6073a5cb249e78fac6eba4f1e38e6cb8c53b6439a46f3ed2d2b63da1792fd0d2a28766fe9773ee3f2ba7a1e2b8f2
-
SSDEEP
393216:jknyxhyCY8vgCNyttxDWRRfkWHljIZQRXrNEBjI21AwtagHGUB:YyxhyL4fOD05kWHl7C3yBO
Malware Config
Signatures
-
resource yara_rule static1/unpack001/out.upx detect_ak_stuff -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource ab65a12972e7c47c5a24a4fd672edd90837bacd34dfedc2b48b2c7efe2bf559c unpack001/out.upx
Files
-
ab65a12972e7c47c5a24a4fd672edd90837bacd34dfedc2b48b2c7efe2bf559c.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 30.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 15.8MB - Virtual size: 15.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 23.4MB - Virtual size: 23.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.9MB - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 877KB - Virtual size: 877KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rodata Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ