Behavioral task
behavioral1
Sample
x-ping4/x-ping/Release/upx.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
x-ping4/x-ping/Release/upx.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
x-ping4/x-ping/Release/x-ping4.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
x-ping4/x-ping/Release/x-ping4.exe
Resource
win10v2004-20231215-en
General
-
Target
276450507e37ff38dd5f72e5bd19ea37
-
Size
102KB
-
MD5
276450507e37ff38dd5f72e5bd19ea37
-
SHA1
baf09b3a89c40528c03a69fba0baa63f147f4af4
-
SHA256
55f207fb87501a865f5b46435a75f1602bdb01f4317de67fb700c613d5d9a37f
-
SHA512
8a4f3e1cb8f931218dab2a0bcf0bad9a3bdac9ba61eee104a345839b924614c7c44885551e5514cf52a60e50209471c1fd6f7de06383dd319264c0e6692ae5ff
-
SSDEEP
3072:OrBIdmh8pCwj42v7YOw8pCklhiaLFKShhTo9p:W+dmh8kKXyfyiiKq6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/x-ping4/x-ping/Release/upx.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/x-ping4/x-ping/Release/upx.exe unpack001/x-ping4/x-ping/Release/x-ping4.exe
Files
-
276450507e37ff38dd5f72e5bd19ea37.rar
-
x-ping4/x-ping/Release/upx.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
OPX0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 90KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
x-ping4/x-ping/Release/x-ping4.exe.exe windows:4 windows x86 arch:x86
2068c60dea49cd6098a2ebe02029be9d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAStartup
socket
htons
connect
send
recv
closesocket
WSASocketA
setsockopt
sendto
gethostbyname
inet_addr
kernel32
HeapReAlloc
RtlUnwind
LoadLibraryA
GetCurrentProcess
TerminateProcess
GetProcAddress
Sleep
GetTickCount
GetCurrentProcessId
GetProcessHeap
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
CreateThread
ExitProcess
TerminateThread
GetSystemTimeAsFileTime
GetCurrentThreadId
HeapFree
VirtualAlloc
HeapAlloc
QueryPerformanceCounter
user32
MessageBoxA
advapi32
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteA
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
x-ping4/x-ping/x-ping.cpp
-
x-ping4/x-ping/x-ping.sln
-
x-ping4/x-ping/x-ping.suo
-
x-ping4/x-ping/x-ping.vcproj.xml