Behavioral task
behavioral1
Sample
25bd84ae84ce661647d308bff0e0869d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25bd84ae84ce661647d308bff0e0869d.exe
Resource
win10v2004-20231215-en
General
-
Target
25bd84ae84ce661647d308bff0e0869d
-
Size
16KB
-
MD5
25bd84ae84ce661647d308bff0e0869d
-
SHA1
2d12fdc901cdb7a5eecafee4b7545a8089058e0c
-
SHA256
e442bc48cc336d06978e2d2c83449b2bae09a74345b95b380c9a5d8d13010281
-
SHA512
67cf051364b5f7ada6549db48aba2dcefe07c42416a06cffcaab34ed3a36131390b364db6ee53fcebd65cbc7c8f8bde427b2e2facb4f77db45853e465ab6180f
-
SSDEEP
192:CHsJesB1W7dYxQiQ+1dbiqjq589qbic5YPtXVr8M24JbnMj6sl6F90TZs1CM0n:sgjE7q+iOqjq5iqratlQfSfs1swF
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 25bd84ae84ce661647d308bff0e0869d unpack001/out.upx
Files
-
25bd84ae84ce661647d308bff0e0869d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 96B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE