Behavioral task
behavioral1
Sample
Keygen.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Keygen.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
is155219.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
is155219.exe
Resource
win10v2004-20231215-en
General
-
Target
41e5e81d7b72ea6c3f9aab999e3ad4f7
-
Size
200KB
-
MD5
41e5e81d7b72ea6c3f9aab999e3ad4f7
-
SHA1
67fbb5808c1f9c11c3f4b4328c3d8c647690e2e5
-
SHA256
7dbbd82d4146f24f67004e2f1af822c7b33cc400a8ef7ba24df5f7c3adcfe27a
-
SHA512
e2bde8d02610023ce01578a2ad17ff6cd1c9c5053c9ca8d1d415dec3ceab5008d8fc21b63ddb01916e1ced45812af848eacc258aabf68a7b8251498649910f05
-
SSDEEP
3072:a0YxWgaj6LyfgL2GXPAG4ZptRib5nwVgEtOlHxa+YE4AOUeVPQEbXmSEUDDo1:apWgc7fDG43vtRQ5nwWEgPa5XnbPc
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Keygen.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Keygen.exe unpack002/out.upx unpack001/is155219.exe
Files
-
41e5e81d7b72ea6c3f9aab999e3ad4f7.cab
-
Keygen.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 118KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
is155219.exe.exe windows:4 windows x86 arch:x86
8d12a4923c05b102ffd0024fd6cae42a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
DrawMenuBar
DrawIcon
DialogBoxParamA
DestroyWindow
DestroyIcon
DestroyCaret
DeleteMenu
DefDlgProcA
CreateMDIWindowA
CreateIconFromResourceEx
CreateIconFromResource
CreateDialogParamA
CreateAcceleratorTableA
CopyImage
CharToOemA
CharPrevA
BeginPaint
kernel32
EnumResourceTypesA
lstrlenA
lstrcpyA
lstrcmpA
lstrcatA
UnmapViewOfFile
TlsAlloc
RtlUnwind
RaiseException
MapViewOfFile
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GetSystemTime
GetStartupInfoA
GetFileSize
GetDateFormatA
FindResourceA
CloseHandle
EnterCriticalSection
ExitThread
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE