Behavioral task
behavioral1
Sample
25d0757108489b40264cbfddec2a978d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25d0757108489b40264cbfddec2a978d.exe
Resource
win10v2004-20231215-en
General
-
Target
25d0757108489b40264cbfddec2a978d
-
Size
194KB
-
MD5
25d0757108489b40264cbfddec2a978d
-
SHA1
c7e68f7b81e6b3a811b636be392d3636c33467b3
-
SHA256
79fb8dce77db7f6de5eaf7fe4d7a70a6e96ddccc6f8b8ae37ea2dbbfa216fece
-
SHA512
b3db42860befd4fb49789c632245c31b23180906bfb10c74e8d54615d10f354834816e6490ad24965f037dc17d3f857164ca2e0c8232f86f7d52959b4af38437
-
SSDEEP
3072:7a3/VSSWwPUgycxk7JhqQ8qAscPPkj90/pD+KduxZnt:7a31Ugy33WqXskIFddu5
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25d0757108489b40264cbfddec2a978d
Files
-
25d0757108489b40264cbfddec2a978d.exe windows:4 windows x86 arch:x86
fc178ca4869dab36460576ba904c1a46
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
VirtualAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetLocalTime
GetTickCount
Sleep
ReadFile
CloseHandle
GetFileSize
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateThread
GetModuleFileNameA
CopyFileA
TerminateThread
ExitProcess
GetSystemDirectoryA
GetSystemDefaultLangID
GetComputerNameA
SetThreadPriority
GetThreadPriority
GetCurrentThread
SetPriorityClass
GetPriorityClass
GetCurrentProcess
QueryPerformanceCounter
QueryPerformanceFrequency
OpenProcess
TerminateProcess
CreateProcessA
GetLastError
CreateMutexA
WriteFile
ExpandEnvironmentStringsA
GetShortPathNameA
GetTempPathA
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
VirtualFree
HeapCreate
HeapDestroy
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetCurrentProcessId
ReleaseMutex
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapAlloc
HeapFree
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegCloseKey
GetUserNameA
gdi32
GetDeviceCaps
mpr
WNetOpenEnumA
WNetAddConnection2A
WNetCancelConnectionA
WNetEnumResourceA
WNetCloseEnum
shlwapi
PathRemoveFileSpecA
user32
GetDC
CharToOemA
EnumWindows
GetParent
IsWindowEnabled
ReleaseDC
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextA
GetClassNameA
wininet
HttpQueryInfoA
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetGetConnectedState
wsock32
ntohl
getsockname
inet_ntoa
accept
listen
bind
WSACleanup
gethostname
gethostbyname
inet_addr
getpeername
__WSAFDIsSet
recv
send
shutdown
closesocket
socket
htons
htonl
connect
sendto
select
recvfrom
ioctlsocket
getsockopt
WSAGetLastError
WSAStartup
Sections
UPX0 Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE