Behavioral task
behavioral1
Sample
525e88b1d95b957c9f911bf7b832b592.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
525e88b1d95b957c9f911bf7b832b592.exe
Resource
win10v2004-20231215-en
General
-
Target
525e88b1d95b957c9f911bf7b832b592
-
Size
120KB
-
MD5
525e88b1d95b957c9f911bf7b832b592
-
SHA1
ee92b33d150f333f5cad706d7b90b6339e38c65b
-
SHA256
55b214462cd60b8e6e71c53b9a0fb897715a58b909ca266af9ff965828e64280
-
SHA512
d14b38ade7ce8df629fe24e765372420895c6f92f52e7fcc796fd9662c3d3cb17525a08af6b5149c81d8189d20544d1bb904565edec610f897cfae03dcfaf18f
-
SSDEEP
768:UU307c92/EyTAYtxqfGNC0klI7C8ycYlI5o194jpm6zxb1:UUE7wc1aGNC0klI7CPpIQawYb
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 525e88b1d95b957c9f911bf7b832b592
Files
-
525e88b1d95b957c9f911bf7b832b592.exe windows:4 windows x86 arch:x86
6786ed16c434f43e76d0897f96e17f6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempFileNameA
WriteFile
GetSystemTime
GetCurrentThread
SetThreadPriority
GetDriveTypeA
GlobalAlloc
FindFirstFileA
FindNextFileA
FindClose
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
InterlockedIncrement
InterlockedDecrement
GlobalFree
SetEndOfFile
GetEnvironmentVariableA
GetLastError
CreateMutexA
GetFileAttributesA
CopyFileA
DeleteFileA
CloseHandle
CreateFileA
SetFileAttributesA
lstrlenA
GetTempPathA
GetWindowsDirectoryA
lstrcatA
lstrcpyA
GetModuleFileNameA
ExitThread
Sleep
CreateThread
ExitProcess
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetTickCount
WideCharToMultiByte
GetProcAddress
LoadLibraryA
GetModuleHandleA
ReadFile
SetFilePointer
lstrcmpiA
GetProcessHeap
HeapAlloc
lstrcpynA
lstrcmpA
HeapFree
advapi32
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegEnumKeyA
RegQueryValueExA
msvcrt
memset
tolower
memcpy
isdigit
strchr
isalnum
isspace
strlen
strcpy
strstr
malloc
strcat
realloc
fclose
fread
fopen
time
fwrite
system
memcmp
free
user32
CharUpperBuffA
CharUpperA
CharLowerA
wvsprintfA
wsprintfA
FindWindowA
PostMessageA
ws2_32
bind
listen
accept
htonl
ntohl
connect
send
inet_addr
gethostbyname
socket
select
recv
closesocket
ntohs
htons
sendto
WSAStartup
gethostname
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE