Behavioral task
behavioral1
Sample
00f9d0525366a37cb4f21eded9ce2198.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
00f9d0525366a37cb4f21eded9ce2198.exe
Resource
win10v2004-20231215-en
General
-
Target
00f9d0525366a37cb4f21eded9ce2198
-
Size
63KB
-
MD5
00f9d0525366a37cb4f21eded9ce2198
-
SHA1
ad18d9458c8503d2b2b9350880385fb083851c8d
-
SHA256
f002e2f0371aa87d59ca0ab21b3202eef3415057608517684e33c76b0a9284b8
-
SHA512
7e700c951d7e52b8af6e379b6b744c518adcb129da3e3e16385d401a0425a2cb1e05d1b7e2fa56c506765c0e5082aa3ccd0e5c07500327cdd027ddd9261011f9
-
SSDEEP
768:oN9AIhw12kBvZx4vFCHZwXuxRy8kpapTnd55CQSYk+qHHE0AK:orA1wtvbXuxRipWUIbzK
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00f9d0525366a37cb4f21eded9ce2198
Files
-
00f9d0525366a37cb4f21eded9ce2198.exe windows:4 windows x86 arch:x86
c966fe224bc28988cab3909fe28c4c07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetLastError
CreateMutexA
GetTickCount
Sleep
LoadResource
FindResourceA
MultiByteToWideChar
WideCharToMultiByte
CopyFileA
CreateThread
SizeofResource
TerminateThread
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
CreateFileA
SetFilePointer
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
CloseHandle
WriteFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
GetStringTypeW
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
mpr
WNetAddConnection2A
WNetCancelConnection2A
netapi32
NetRemoteTOD
NetApiBufferFree
NetScheduleJobAdd
NetUserEnum
ws2_32
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE