Behavioral task
behavioral1
Sample
3e59534a3b28e1fba5c39a731d1fd2c4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3e59534a3b28e1fba5c39a731d1fd2c4.exe
Resource
win10v2004-20231215-en
General
-
Target
3e59534a3b28e1fba5c39a731d1fd2c4
-
Size
378KB
-
MD5
3e59534a3b28e1fba5c39a731d1fd2c4
-
SHA1
843c3971d61c8e175c75dc2e85cd2881fc878a65
-
SHA256
7f530b6daf2b81c3c87b8388488934722709c11656f3849647113a66ab8f21e5
-
SHA512
67a096419e97b5bbeab6736b679b6f77e8c6a9ee5b24a0e508bfbf1cc52c54caa70c3dd25cc2353947efec181817b536e09b1b765fbeada3475aaab0f265a289
-
SSDEEP
6144:xvuTiW9mGjGcfRKMIyMZxf5RNlCyMasmCc9/4WD9g0hJDsdWYzAu2pQ3q:509zjGOjILfRoyMjmH9/4WDtJDyWYAuo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e59534a3b28e1fba5c39a731d1fd2c4
Files
-
3e59534a3b28e1fba5c39a731d1fd2c4.exe windows:4 windows x86 arch:x86
9c8decf3582072f6edfc385a689f44f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile
Sections
UPX0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE