Behavioral task
behavioral1
Sample
fd1ac113ea504d58054d2d285cfc498e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fd1ac113ea504d58054d2d285cfc498e.exe
Resource
win10v2004-20231215-en
General
-
Target
fd1ac113ea504d58054d2d285cfc498e
-
Size
268KB
-
MD5
fd1ac113ea504d58054d2d285cfc498e
-
SHA1
f5d568bc90dbd9dde5eada1c84f1b4cbbf68db60
-
SHA256
6e917a0bfd0543e70ec875a0d319bbe40a8253c5f93b2d6a45c366b16e4bf0fb
-
SHA512
b70fd070f0673439cabfb21d77780e6a78214c947838fffcd3d09fff889a4fa481f1225c142cf755e81757318c051172a678d3848b860a29eca4a2f805286f95
-
SSDEEP
6144:v5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:rATkKbbxI9CEHFJzCCsCfYWivpvN20T
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd1ac113ea504d58054d2d285cfc498e
Files
-
fd1ac113ea504d58054d2d285cfc498e.exe windows:4 windows x86 arch:x86
3039a04ea8ae6568d1f1f38e4ea28e48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOIDToAlgId
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CryptMsgGetParam
CertEnumCertificatesInStore
CertDuplicateStore
CryptMsgUpdate
CertGetNameStringA
CertCloseStore
CertCompareCertificateName
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptDecodeObject
CryptMsgClose
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
kernel32
GetLastError
GetModuleHandleA
GetModuleFileNameW
MoveFileW
MoveFileA
GetModuleFileNameA
MultiByteToWideChar
WaitForSingleObject
CreateSemaphoreA
SetEvent
CreateEventA
GetSystemTime
FreeLibrary
InitializeCriticalSection
LoadLibraryA
GetExitCodeThread
WaitForMultipleObjects
GetVersionExA
GetCurrentThreadId
LoadResource
Sleep
GetSystemInfo
RaiseException
ExitProcess
GetCurrentProcess
HeapCreate
IsBadWritePtr
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
lstrcmpA
GetProcAddress
user32
CharUpperA
advapi32
RegSetValueExA
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
CryptGetHashParam
ole32
StringFromCLSID
scecli
SceStartTransaction
SceRegisterRegValues
SceAddToNameList
DllUnregisterServer
SceDcPromoCreateGPOsInSysvolEx
SceGetServerProductType
kbdkaz
KbdLayerDescriptor
Sections
UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kREZn Size: 4KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 91KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ocUcy Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XtjX Size: 2KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 131KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xQ Size: 5KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ