Behavioral task
behavioral1
Sample
2aa3dca56f8ec48e8a63eb3339cb1777.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2aa3dca56f8ec48e8a63eb3339cb1777.exe
Resource
win10v2004-20231215-en
General
-
Target
2aa3dca56f8ec48e8a63eb3339cb1777
-
Size
27KB
-
MD5
2aa3dca56f8ec48e8a63eb3339cb1777
-
SHA1
f10ecccda5325ecd1718c8c7ce6e855e3f6bab75
-
SHA256
8d7e8d003debc558abc9709a5617d3e32fff290b938a011e15b13d2395c3f35e
-
SHA512
b4ffcd0b35ed14ba122648a2d08fbd8dd28acc286e22923e7da22588e8284247eef60ec2008a06d1bc99082525bfbb192edd8269b455603051a07390c9ed1ee1
-
SSDEEP
384:dMJGPI6f9ZSZo3H1gNWQSSv/kURDwj92xg/y+qhNYhjtMKsvFKaDuW:dMEI6f9cZUzKHksxKhWGjtMKsvcaJ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2aa3dca56f8ec48e8a63eb3339cb1777
Files
-
2aa3dca56f8ec48e8a63eb3339cb1777.exe windows:4 windows x86 arch:x86
56d9cda6c82cd828c11a9fc2f0a1df89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetModuleFileNameA
Sleep
WriteFile
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
GetSystemDirectoryA
WaitForSingleObject
ExitProcess
CreateThread
TerminateProcess
OpenProcess
CreateEventA
OpenEventA
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
GetVersionExA
GetFileSize
GetWindowsDirectoryA
CreateFileA
GetFileTime
SetFileTime
GetCurrentProcess
SetThreadPriority
CloseHandle
advapi32
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
user32
SendMessageA
FindWindowA
GetWindow
EnumThreadWindows
GetWindowTextA
GetClassNameA
PostMessageA
wsprintfA
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE