Behavioral task
behavioral1
Sample
08573864fd34f8f7a463d04e0eb0de15.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08573864fd34f8f7a463d04e0eb0de15.exe
Resource
win10v2004-20231215-en
General
-
Target
08573864fd34f8f7a463d04e0eb0de15
-
Size
68KB
-
MD5
08573864fd34f8f7a463d04e0eb0de15
-
SHA1
b9d61d5c11a4c5b0a34750c2b5332029b14fce28
-
SHA256
a0c8b3746762043ec1c0c52f6b4774e80b46b2aece6c96dde6b0dc23194ec604
-
SHA512
efae5b023fb624e8ba92b669330455cde22e182e140db3359ff03a0e493e192d5da34404fc7a8d5cc65811c09e26d491bc1d6d6e559269aefbc10a3d4505616b
-
SSDEEP
768:QyuPlTnPay/ija+1IH5SEGbrUY6p5SJtwa1hLLeEufvWt1tNpf8:QyuPlT1SEGX5HJtddLv2AT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08573864fd34f8f7a463d04e0eb0de15
Files
-
08573864fd34f8f7a463d04e0eb0de15.exe windows:5 windows x86 arch:x86
e9ac615ed7ca82752a23498a52dfcd39
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
user32
MessageBoxA
MessageBoxW
kernel32
lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLastError
GetCommandLineW
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateFileW
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
GetVersionExW
FreeLibrary
CreateFileW
CloseHandle
shell32
ShellExecuteW
SHGetSpecialFolderPathW
Sections
UPX0 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE