Behavioral task
behavioral1
Sample
f96baf54a4d1670598eb90767f2ae1af.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f96baf54a4d1670598eb90767f2ae1af.exe
Resource
win10v2004-20231222-en
General
-
Target
f96baf54a4d1670598eb90767f2ae1af
-
Size
44KB
-
MD5
f96baf54a4d1670598eb90767f2ae1af
-
SHA1
b7a6abf5cac78c67f11bacfee991075f2fe45aa3
-
SHA256
c189bd6756ba01c40c74f89feb37e4f2831683221b7657349c59553c9d5260d6
-
SHA512
f55fc34c5d4a8edf31b4b3c86b5dd6a5de58bf25e8e45a06562a9c9bb5da1d61d28799466115528042fac9b01b996085b7426cc5193c3a7fe701aa3a63222fd0
-
SSDEEP
768:alDNwrJzDhMq+AGyw56sC7NTqFQLUipHL:alyRDhMww8sCIILx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f96baf54a4d1670598eb90767f2ae1af
Files
-
f96baf54a4d1670598eb90767f2ae1af.exe windows:4 windows x86 arch:x86
626c32f8c049a28685acb42fddbdf497
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateMutexA
CreateThread
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GetStartupInfoA
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultLangID
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalLock
GlobalReAlloc
GlobalUnlock
LoadLibraryA
LoadResource
LockResource
MoveFileA
MultiByteToWideChar
OpenProcess
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
WinExec
CreateToolhelp32Snapshot
Process32First
Process32Next
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
gdi32
BitBlt
CombineRgn
CreateCompatibleDC
CreateDIBSection
DeleteDC
DeleteObject
ExtCreateRegion
GetCurrentObject
GetObjectA
GetRgnBox
SelectObject
msvcrt
__getmainargs
__p__environ
__set_app_type
_cexit
_fileno
_fmode
_fpreset
_iob
_setmode
_stricmp
_wfsopen
atexit
calloc
fclose
fopen
free
malloc
memcpy
rand
signal
srand
strcat
strchr
strcmp
strcpy
strncmp
strncpy
strrchr
strstr
_itoa
_strlwr
_strset
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
shell32
ShellExecuteA
user32
EndDialog
EnumWindows
FindWindowA
GetClientRect
GetDlgItemTextA
GetWindowRect
GetWindowTextA
InvalidateRect
MessageBoxA
SendMessageA
SetRect
SetWindowPos
wininet
DeleteUrlCacheEntry
FindCloseUrlCache
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE