Behavioral task
behavioral1
Sample
09ab45b1f849e2a408242e90380f2cee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09ab45b1f849e2a408242e90380f2cee.exe
Resource
win10v2004-20231215-en
General
-
Target
09ab45b1f849e2a408242e90380f2cee
-
Size
4.1MB
-
MD5
09ab45b1f849e2a408242e90380f2cee
-
SHA1
bc5b9ae11a7a8fff0276cf5d7c11e1f23ebfd395
-
SHA256
9bbe42be6e9ce0ac3692dfbd4f0ed98eddbde926f8bdecef79964d9bce924101
-
SHA512
6c61f0b0faf16a34592ba01e57e223025b759cebd4a4d958c7fc8e905c117383aa9381c06c47af4b48fbf55da4eeb5c2be9ac569f739019fdb2b91c942fc302c
-
SSDEEP
98304:2+NUd6nQFyJ9H32y7jZIMD7+ToxuuCv4cn0gXyOn1cpNIVz:2r4QU9HGyJjP+8xZkpnFXyO1EI5
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 09ab45b1f849e2a408242e90380f2cee unpack001/out.upx
Files
-
09ab45b1f849e2a408242e90380f2cee.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 43KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ