Behavioral task
behavioral1
Sample
2d61e56bdedf1aaf484f60d520213dc6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2d61e56bdedf1aaf484f60d520213dc6.exe
Resource
win10v2004-20231222-en
General
-
Target
2d61e56bdedf1aaf484f60d520213dc6
-
Size
57KB
-
MD5
2d61e56bdedf1aaf484f60d520213dc6
-
SHA1
aec3fbc87626036e26b13bc983692f2fb10168af
-
SHA256
62a8ce9853e52346d8e4facc4e4b8d9b2a4971e501c2306a312a990cd0c33e52
-
SHA512
a2675194776044f1719b37f0d7834b941d9d53c89f843d6d289c738a85739bea1b5744d39ae07040889abef1040cbe204fb8913a731514b3ddcf1cfd3a573b14
-
SSDEEP
1536:0qobaZzMjvjj2XmcerYTKPuLH2237jT6al0UJeAK4Z7nvbJq5LI:uOZQjvjj2XmcerYTKPu6Y7jzK2vbJcLI
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d61e56bdedf1aaf484f60d520213dc6
Files
-
2d61e56bdedf1aaf484f60d520213dc6.exe windows:1 windows x86 arch:x86
2c16aa3fa1411c61d58f9d276c92ba51
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CopyFileA
CreateFileA
DeleteFileA
EnumResourceNamesA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FreeEnvironmentStringsA
GetCommandLineA
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentVariableA
GetFileType
GetLastError
GetModuleHandleA
GetStartupInfoA
GetStringTypeA
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalReAlloc
MoveFileA
MultiByteToWideChar
ReadFile
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
WriteFile
CreateFileMappingA
OpenProcess
ReadProcessMemory
RtlMoveMemory
advapi32
RegCloseKey
RegOpenKeyA
RegSetValueExA
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetTextMetricsA
MoveToEx
SelectObject
SetBkColor
SetBkMode
SetTextAlign
SetTextColor
ole32
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID
oleaut32
GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
user32
AttachThreadInput
CharLowerBuffA
CharNextA
CharUpperBuffA
CheckRadioButton
ClientToScreen
CreateDialogIndirectParamA
CreateDialogParamA
CreateWindowExA
DestroyIcon
DestroyWindow
DialogBoxIndirectParamA
DispatchMessageA
EnableWindow
FillRect
FindWindowA
GetClientRect
GetDC
GetDlgItem
GetForegroundWindow
GetMenu
GetMenuItemInfoA
GetSysColor
GetSysColorBrush
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowThreadProcessId
IsDialogMessageA
IsWindow
LoadImageA
MapDialogRect
PeekMessageA
PostMessageA
RedrawWindow
ReleaseDC
ScreenToClient
SendMessageA
SetFocus
SetForegroundWindow
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TranslateMessage
DialogBoxParamA
GetFocus
GetWindow
SetTimer
wininet
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetOpenUrlA
InternetReadFile
Sections
UPX0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE