Behavioral task
behavioral1
Sample
2feb9bf19cc90bcfb4c7cdbccb61b329.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2feb9bf19cc90bcfb4c7cdbccb61b329.exe
Resource
win10v2004-20231215-en
General
-
Target
2feb9bf19cc90bcfb4c7cdbccb61b329
-
Size
345KB
-
MD5
2feb9bf19cc90bcfb4c7cdbccb61b329
-
SHA1
66a7f3d320f6706d339c0df3ba823cd8805d4af4
-
SHA256
79fadbfb802a5a1c81d20e2e6fcf395e51f4561bc917d1af87d9b45acfb03135
-
SHA512
e6d6e4812073000b7815d7202abd555f813a190f33f7867dd70a5fece8ba8cc7111c933330a979cc273982b32c27a6c9ecdcb18897dd9bb5b4c2733a347c1186
-
SSDEEP
3072:d7xUB0LaK4DrHjuHVBbyTcQd89uUvF7P1RfORHnBBRk6uob+BsbyCJ1:d7uoaKQHECc8wnV70HWsNu2
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2feb9bf19cc90bcfb4c7cdbccb61b329
Files
-
2feb9bf19cc90bcfb4c7cdbccb61b329.exe windows:10 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 142KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE