Behavioral task
behavioral1
Sample
2f57b2a8b76c9c452e3b0fa475725f85.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2f57b2a8b76c9c452e3b0fa475725f85.exe
Resource
win10v2004-20231222-en
General
-
Target
2f57b2a8b76c9c452e3b0fa475725f85
-
Size
523KB
-
MD5
2f57b2a8b76c9c452e3b0fa475725f85
-
SHA1
72da9a939be07d390d7367590ddfa0b8ce21d78d
-
SHA256
e9bf06bf6e77d67ce3685580788d79032e021e07d55101f725267b7cf50683e8
-
SHA512
bfba970b82831c6b6db976beb48eb6a130c5468ed762c0e7cfa43a5522851c39cfeb747cd7728c88fb9a18525bef4dab3c53a06c6009d7097e6837cbaf2065db
-
SSDEEP
12288:PLuqy4GFf2lEPw2/95LSOHdqwCUE7yDO:DuqyVFOlEZl5+4syy
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f57b2a8b76c9c452e3b0fa475725f85
Files
-
2f57b2a8b76c9c452e3b0fa475725f85.exe windows:5 windows x86 arch:x86
c063722393457a05b12aadac8aeacd3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
PtInRect
gdi32
ExtSelectClipRgn
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
advapi32
RegOpenKeyExW
shell32
Shell_NotifyIconW
comctl32
ord17
shlwapi
PathIsUNCW
oledlg
OleUIBusyW
ole32
CoRegisterMessageFilter
oleaut32
VariantCopy
ws2_32
WSCEnumProtocols
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 162KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 359KB - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE