Behavioral task
behavioral1
Sample
Rus_npatch.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Rus_npatch.exe
Resource
win10v2004-20231222-en
General
-
Target
50fffb13224b36150623c50a4af58370
-
Size
49KB
-
MD5
50fffb13224b36150623c50a4af58370
-
SHA1
ec27ee8ab7fe6abd4cae6fc2ecb8e8e47c4a9842
-
SHA256
05b1e7d079c865535f045b39b3bd9a26129f0b6a966f723eb83efe6fbe37f6b5
-
SHA512
003d2d983f3b49fe4ece9f0175237e85270da43fd78e2e0331d8fe19f21d24391289f27c7bf3f1377487c858d97bab43145a2c45e63723a49fbd81c6e4dbae9c
-
SSDEEP
768:PdCEbsc3lInmgXoP2zd8K+GB4I/Dn5jmF0MQ/hlLs/mVtZx+wdkGpV3hLc2IhF59:PdXb33lg7T+oD0hWBVtzl1f3Nw5T+Ql
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Rus_npatch.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rus_npatch.exe
Files
-
50fffb13224b36150623c50a4af58370.rar
-
Rus_npatch.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE