Behavioral task
behavioral1
Sample
1b346d5a17ccede743647875e010bfca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1b346d5a17ccede743647875e010bfca.exe
Resource
win10v2004-20231215-en
General
-
Target
1b346d5a17ccede743647875e010bfca
-
Size
80KB
-
MD5
1b346d5a17ccede743647875e010bfca
-
SHA1
e2763d6b28b9ec0b96171277f0cb645ddd60dd15
-
SHA256
f04e32998eca768c008ea19767f5736b58a5a4e0bbfcb0936deefd0cd10db528
-
SHA512
464ba58b8935c7da052643cd7c2df74e5f40d89359b3445771fd7776ba2b53a6e5ee6f9c3371e4927a143bc9aab4679eceb19dc1ab6c596c36363fce1501dfe9
-
SSDEEP
768:GKg4QwUzW+f3S9lfAxBu4wK4tu2xgQsqInwt9a7:QyL9lfALdIxXYnS9m
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b346d5a17ccede743647875e010bfca
Files
-
1b346d5a17ccede743647875e010bfca.exe windows:4 windows x86 arch:x86
a50d9bca5b883b2ac42bdcf479fcf8f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetShortPathNameA
GlobalFree
GlobalAlloc
GetTickCount
GetTempPathA
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
CreateThread
GetLastError
CreateMutexA
GetPrivateProfileStringA
WritePrivateProfileStringA
TerminateProcess
OpenProcess
Process32Next
DeleteFileA
CreateToolhelp32Snapshot
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
GetOEMCP
Sleep
MultiByteToWideChar
GetWindowsDirectoryA
FindResourceA
LoadResource
CreateFileA
SizeofResource
WriteFile
Process32First
CloseHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetVersion
GetCommandLineA
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
ole32
CoUninitialize
CoInitialize
shell32
ShellExecuteA
user32
MessageBoxA
ShowWindow
SendMessageA
SetDlgItemTextA
FindWindowA
BringWindowToTop
SetActiveWindow
GetDlgItem
EnableWindow
GetWindowTextA
SetForegroundWindow
keybd_event
EnumWindows
Sections
UPX0 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE