Behavioral task
behavioral1
Sample
5899cb66b9dbc26b9f376016968e125d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5899cb66b9dbc26b9f376016968e125d.exe
Resource
win10v2004-20231215-en
General
-
Target
5899cb66b9dbc26b9f376016968e125d
-
Size
135KB
-
MD5
5899cb66b9dbc26b9f376016968e125d
-
SHA1
42f83e98b0cc67f14fe0b5277d55248104be7123
-
SHA256
988ba4c9ce54ed751d9e6ece6af4ca6df270b6837fcfb6b841cf56b35f75aa2f
-
SHA512
848ee3f8094489bb256bbdff14cd1e638238f480e98a89c59adfed9d3564b7ec0f33b87ed5b96febbf2716627cd6620b2e3eed8695c7dedc57685e5e34272af6
-
SSDEEP
3072:9tdHkqxDLVRaRiv/AlpaaRXj5B25sEbWz5sdr/Y6PXnC2ibUPuqnVG8+BwqOzFGQ:TdEoDHaRiv/AlpaaRXj5B25sEbWz5sdb
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5899cb66b9dbc26b9f376016968e125d
Files
-
5899cb66b9dbc26b9f376016968e125d.exe windows:4 windows x86 arch:x86
9fd32147b9acab012440c0e6638b31a8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
WriteFile
SizeofResource
MapViewOfFile
LockResource
LoadResource
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetLastError
FreeResource
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
DeleteFileA
CreateSemaphoreA
CreateFileMappingA
CreateFileA
CopyFileA
CloseHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegCloseKey
user32
GetKeyboardType
MessageBoxA
CharNextA
GetMessageA
Sections
UPX0 Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE