Behavioral task
behavioral1
Sample
5ce85a9350919e6324ee10f69ab0800e.exe
Resource
win7-20231215-en
General
-
Target
5ce85a9350919e6324ee10f69ab0800e
-
Size
181KB
-
MD5
5ce85a9350919e6324ee10f69ab0800e
-
SHA1
bf601e2f78cf8bba7f63152a70f5379ce54cc819
-
SHA256
32d7b1ac33a669a29d58510ded1cf807b5829749d29e4680e335bd2b2c153504
-
SHA512
5e7846678d855720c290ab9bbc0a59b50d7d304594713b648bb76c19daec3033ac4689a888818f975bfe0144f5a82c5840cec4d174594b343f67420f40272bfa
-
SSDEEP
3072:z/5KFl81i04l2Fv2f9tMUr6of9MRNwda7KVr0cHneunw1oO:z/5KFl81jDv72RFMReGir0cHneMwqO
Malware Config
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ce85a9350919e6324ee10f69ab0800e
Files
-
5ce85a9350919e6324ee10f69ab0800e.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
POLSJDKW Size: 124KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
POLSJDKW Size: 55KB - Virtual size: 56KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE