Behavioral task
behavioral1
Sample
352ef00883e5545680f319ab5bfb3b1bd352cc33dc938bb18e2a3b600bc923d7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
352ef00883e5545680f319ab5bfb3b1bd352cc33dc938bb18e2a3b600bc923d7.exe
Resource
win10v2004-20231215-en
General
-
Target
352ef00883e5545680f319ab5bfb3b1bd352cc33dc938bb18e2a3b600bc923d7
-
Size
4.8MB
-
MD5
363da9d82498c5e4ca299c9a0966be34
-
SHA1
0f63608f77a1917bdc719163b93a7d73876212d2
-
SHA256
352ef00883e5545680f319ab5bfb3b1bd352cc33dc938bb18e2a3b600bc923d7
-
SHA512
79eb5fcc12c24671e53f80da7e7540b46403c988f973ecfbff0a852e69675d57c4a9b2d36d3661611f854f06980b12a5dd66377ac3485b1effa9883bdb20a028
-
SSDEEP
98304:/U082eIbGPDjr4BAG38Yd/YZqERB/uuDXAUjKASYUIWXoJizbK4Q:/UIeAGPDRG38iQqWBmKAUj55DyoJizbe
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 352ef00883e5545680f319ab5bfb3b1bd352cc33dc938bb18e2a3b600bc923d7 unpack001/out.upx
Files
-
352ef00883e5545680f319ab5bfb3b1bd352cc33dc938bb18e2a3b600bc923d7.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 10.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 392KB - Virtual size: 801KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ