Behavioral task
behavioral1
Sample
is151287.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
is151287.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
keymaker.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
keymaker.exe
Resource
win10v2004-20231215-en
General
-
Target
40fcc54f971ca27dd1592604246179ad
-
Size
166KB
-
MD5
40fcc54f971ca27dd1592604246179ad
-
SHA1
00e02ed9ce41d515beb479584194899a5d406a29
-
SHA256
29cbe89a198b38e4b09c4ab0f260d0440d98f31a28ff7ad230eee3dddc6ef813
-
SHA512
3f4589f5b1a5e25d202d85f7f97e6b94c0eea86d90595abedd422ae2f005b4322c003a3850799bac21e6e408bacb65b385c88cd5071eb92ce927c2305fcdd8f1
-
SSDEEP
3072:rpae7naZ7FULvFR2+zLjRuRFPsECFmlDHNZbe2zZct3iZkHM2wtK4ndccv9Un2tt:rx7khS9o+zLjREFP6YlDHN9z6cj2w04B
Malware Config
Signatures
-
resource yara_rule static1/unpack001/keymaker.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/is151287.exe unpack001/keymaker.exe unpack002/out.upx
Files
-
40fcc54f971ca27dd1592604246179ad.cab
-
is151287.exe.exe windows:4 windows x86 arch:x86
f500bcb4763d9f07870d2b7a3894532a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EndMenu
EndDeferWindowPos
DrawTextA
DrawIcon
DestroyWindow
DeleteMenu
CreatePopupMenu
CreateIcon
CreateDialogParamA
CopyImage
CharUpperBuffA
CharUpperA
BeginPaint
kernel32
lstrcmpiA
SetLastError
SetEndOfFile
LoadResource
LoadLibraryA
GetSystemTime
GetPrivateProfileStringA
GetFileSize
GetCommandLineA
FlushFileBuffers
EnumResourceLanguagesA
lstrcpyA
Sections
.text Size: 19KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
keymaker.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 121KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ