Behavioral task
behavioral1
Sample
ea5b5fa9480cc55a6f72fb2cab3ad4aa.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ea5b5fa9480cc55a6f72fb2cab3ad4aa.exe
Resource
win10v2004-20231215-en
General
-
Target
ea5b5fa9480cc55a6f72fb2cab3ad4aa
-
Size
3.9MB
-
MD5
ea5b5fa9480cc55a6f72fb2cab3ad4aa
-
SHA1
dc215b4040ad6537cda307ad3b309c6023b98775
-
SHA256
5f7d1c13fad99e643dd0cd1989e1ddc486df4ae541d5658b0346b49bd0591b1f
-
SHA512
43aa389021e33db8e73e5ed37341e02459eebb24763b3b42de8165f0f223962b4d90e7b3868ffa99b71eb4577d1b22c6d01b2a21da2cb1d34e5fc99f85d4f7c8
-
SSDEEP
98304:zRgTRKXtD2i7D3xkOxYwpK1Uaw5zptu5gCTA8JD2i7D3xkOxYwpKLDuHbsfDhiVU:9gTROth7FkNqK1Up59tAG8Jh7FkNqKLT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea5b5fa9480cc55a6f72fb2cab3ad4aa
Files
-
ea5b5fa9480cc55a6f72fb2cab3ad4aa.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 500KB - Virtual size: 504KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE