Behavioral task
behavioral1
Sample
d916b2b582d2ec6454a9731055a10f6aefae8e02f3a70d22f7bc427289dd297f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d916b2b582d2ec6454a9731055a10f6aefae8e02f3a70d22f7bc427289dd297f.exe
Resource
win10v2004-20231215-en
General
-
Target
d916b2b582d2ec6454a9731055a10f6aefae8e02f3a70d22f7bc427289dd297f
-
Size
2.0MB
-
MD5
5907b37a1a932052f787696f4262285f
-
SHA1
02ba93ea3d4995a5c4b3de26cae53df4601ebef1
-
SHA256
d916b2b582d2ec6454a9731055a10f6aefae8e02f3a70d22f7bc427289dd297f
-
SHA512
33680edde840f2b0de1e65901febaf314de85132349837166bdc220dc57cacca46acb867755b1679d2ad2385b3b535e6cbf019cac8ccf9d13ce54478d0adfbe5
-
SSDEEP
49152:0dh0tJiT1UwI4kEl3PxAVUczibdGeQIxzli2GEKcqvF1ajaXucdUTlksqYpgvXf:40q1xkEl3JTmi/z42GEKpvhL+TlJQ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource d916b2b582d2ec6454a9731055a10f6aefae8e02f3a70d22f7bc427289dd297f unpack001/out.upx
Files
-
d916b2b582d2ec6454a9731055a10f6aefae8e02f3a70d22f7bc427289dd297f.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 243KB - Virtual size: 625KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ