Behavioral task
behavioral1
Sample
52d4a1b491b4bba277d741b6be3674ab.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
52d4a1b491b4bba277d741b6be3674ab.exe
Resource
win10v2004-20231215-en
General
-
Target
52d4a1b491b4bba277d741b6be3674ab
-
Size
67KB
-
MD5
52d4a1b491b4bba277d741b6be3674ab
-
SHA1
e0bfe40744e9b74ee62b9cf7155bcb33b041a600
-
SHA256
13ec06952e2a6289f2c11a911eba16eb4e655bb81a1ae7ccc92288604e6d6d74
-
SHA512
b42fe320694df60dbffc9bd0939f8e84ee94b14d63ac64b2bdb15eab4b1df69795ea150e20142961ee82f88e9063de95e6baf8b8b59728e80b65c3fbecd4e83a
-
SSDEEP
768:bCyZqlSmQ7xPbGL1hcCHdqdSJQYUUuQcNzAQGqL0x2:ZZqlSmQtT4zr9qYJQlUuNzvh9
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52d4a1b491b4bba277d741b6be3674ab
Files
-
52d4a1b491b4bba277d741b6be3674ab.exe windows:4 windows x86 arch:x86
11b2bef4669616e344c2ff3f464efdd6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
Sleep
SizeofResource
SetFilePointer
ReadFile
LockResource
LoadResource
LoadLibraryA
GetProcAddress
FreeResource
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
DeleteFileA
CreateFileA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
ShellExecuteA
user32
GetKeyboardType
MessageBoxA
CharNextA
Sections
UPX0 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE