Behavioral task
behavioral1
Sample
4d38673249f627de7262ed509953cc098d9493959d1617a40791223bb94dda1c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
4d38673249f627de7262ed509953cc098d9493959d1617a40791223bb94dda1c.exe
Resource
win10v2004-20231023-en
General
-
Target
4d38673249f627de7262ed509953cc098d9493959d1617a40791223bb94dda1c
-
Size
10.5MB
-
MD5
521388aa13a094b7185e1d724edf75d1
-
SHA1
a613fe3b9e9f7b69f6c0e9a44feefa056b79663c
-
SHA256
4d38673249f627de7262ed509953cc098d9493959d1617a40791223bb94dda1c
-
SHA512
c4e18d519d2729643ff53fda993dd5dd6d746b78dcc224fe8b0b91e80b6b871dce5808ac93f0a6ceef07504a943d96ae6a3ddc4eadf0c8531731f00b0c35da2c
-
SSDEEP
196608:eY9sGaJA+2o2EDcyLC4FMIZETSrjPePdrQJ/Bicb86tvPSutsglqO:WHi+2ohcyLCQETSrvJyyChgIO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d38673249f627de7262ed509953cc098d9493959d1617a40791223bb94dda1c
Files
-
4d38673249f627de7262ed509953cc098d9493959d1617a40791223bb94dda1c.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 180KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 127KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Onekey11.1.pyc