Behavioral task
behavioral1
Sample
PB EvoNewPatch #4.exe
Resource
win7-20231215-en
General
-
Target
42a700677c54ee0f3a99e9663669b46d
-
Size
1.9MB
-
MD5
42a700677c54ee0f3a99e9663669b46d
-
SHA1
05deb616aa7f709c3485d12af0d5c6a5602f35c0
-
SHA256
46e413c4bb7a4c867209f6e811988d3aa5b422534d60ddb510910b9257218873
-
SHA512
05e60a567d7f580e9cd74dd947bc47908a850f2d61b7d6827ce248e53dd3b016800932bdfa476e650caf288c013ba787952296357d74cb5eb271d50ff9f2a07f
-
SSDEEP
49152:WqXeQ+CNDYevGM3UqZ8INpgHBrl/hneg9bg:P7NEevGQUqZ8IM3pegZg
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PB EvoNewPatch #4.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PB EvoNewPatch #4.exe unpack002/out.upx
Files
-
42a700677c54ee0f3a99e9663669b46d.rar
-
Cara Buka Cit.jpg.jpg
-
Cara Pakai.txt
-
PB EvoNewPatch #4.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 704KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ