Behavioral task
behavioral1
Sample
5a120a3d47e96bc895606cd7b4f63d4c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5a120a3d47e96bc895606cd7b4f63d4c.exe
Resource
win10v2004-20231215-en
General
-
Target
5a120a3d47e96bc895606cd7b4f63d4c
-
Size
39KB
-
MD5
5a120a3d47e96bc895606cd7b4f63d4c
-
SHA1
149d36273f9f992a1e9a753b526f5a6ec826e83d
-
SHA256
ba769f4d99647ba1f177127eb73e3f89adb9a6b7b74bf3dadad3be5a7abf947b
-
SHA512
bb62e16f28196f219c63c24224ebbde1e927e352fe9e2e01236b65494c7791af52a6bdf589d3b2378d8933b623e3cc85ae722c196f1e7ac2fbdd76fca1661543
-
SSDEEP
384:K43Fr9WYu4LySrwyhB3lvw73x2KjyEoj+DvFjVGlYyqPodG7PdnPfSYnmyv3ZUE6:KW9WYDB3lGk+vn3SGv3ZUEj7V6mT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a120a3d47e96bc895606cd7b4f63d4c
Files
-
5a120a3d47e96bc895606cd7b4f63d4c.exe windows:4 windows x86 arch:x86
bf58773de8d556b36e25a816a6dc3185
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CopyFileA
CreateFileA
ExitProcess
FlushFileBuffers
GetCommandLineA
GetEnvironmentStringsA
GetFileSize
GetFileType
GetLastError
GetModuleHandleA
GetStartupInfoA
GetSystemInfo
GetVersionExA
GlobalAlloc
GlobalFree
GlobalReAlloc
MultiByteToWideChar
ReadFile
SetEndOfFile
SetErrorMode
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
WriteFile
advapi32
RegOpenKeyExA
RegCloseKey
ole32
OleInitialize
OleUninitialize
oleaut32
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy
user32
MessageBeep
Sections
UPX0 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE