Behavioral task
behavioral1
Sample
2474470916eccd0514130a2ec47d6582.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2474470916eccd0514130a2ec47d6582.exe
Resource
win10v2004-20231215-en
General
-
Target
2474470916eccd0514130a2ec47d6582
-
Size
282KB
-
MD5
2474470916eccd0514130a2ec47d6582
-
SHA1
07ca091451c8abe83864135bcecf2f58c26cf196
-
SHA256
429a0eab9ed3570ffcabbae4a6e6c2d52fc67994e3686309a63655f728d3b3b1
-
SHA512
1a906fe138a8040230b98b1df5ac16bb6ce871ae08dc3aee9e12d4935a936ee7c989e22b6cdf3308f920d0824fab378d4deecc8399f07a1c14c5a75c98d6d5d0
-
SSDEEP
6144:qZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:eFTxWYMh5qoLb8LCy9E
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2474470916eccd0514130a2ec47d6582
Files
-
2474470916eccd0514130a2ec47d6582.exe windows:4 windows x86 arch:x86
913a4a367a3cc426f8f8ac8fe6743a43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetSystemDirectoryA
GetVersion
GetVersionExA
GetWindowsDirectoryA
InitializeCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
Sleep
lstrcmpiA
LoadLibraryW
GetProcAddress
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
wsock32
ioctlsocket
inet_addr
comdlg32
GetOpenFileNameW
user32
DestroyIcon
GetSystemMetrics
LoadIconA
PostMessageA
SetFocus
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocStringLen
SysFreeString
scecli
SceStartTransaction
SceGetDatabaseSetting
InitializeChangeNotify
SceRollbackTransaction
SceDcPromoCreateGPOsInSysvolEx
SceAddToNameStatusList
SceSetupUpdateSecurityFile
SceGetObjectChildren
SceIsSystemDatabase
SceEnforceSecurityPolicyPropagation
SceWriteSecurityProfileInfo
advpack
ExtractFiles
OpenINFEngine
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Y Size: 512B - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qvae Size: 4KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T Size: 2KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 139KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tiFp Size: 512B - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aqJji Size: 3KB - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ