Behavioral task
behavioral1
Sample
5a306f3efa626573ac80baa99c4dae68.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a306f3efa626573ac80baa99c4dae68.exe
Resource
win10v2004-20231222-en
General
-
Target
5a306f3efa626573ac80baa99c4dae68
-
Size
46KB
-
MD5
5a306f3efa626573ac80baa99c4dae68
-
SHA1
3c62de418712e15e56a6af0b722cea4bd091aa7a
-
SHA256
6c2d57c5bb2f15fc9390b3adc148ba544f888eab3c49f4a6e93f0b0fc9d4d00e
-
SHA512
b432f1ee4dc9ff73a31821a0b6945ac12029c1a926b12a8334e46aea3ee0b4468bf47e9468503697343e049485ed29abd8e5d1d43a8e69092e86c237191a3eba
-
SSDEEP
384:9mfyyUxJmGw+Y4SWNzb7CT9o6qEK1Z3Cx47to5/87/rCIXna2x0tL4BonVv1H5F6:YfyyUvJNz3CCPdIXQ+Z
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a306f3efa626573ac80baa99c4dae68
Files
-
5a306f3efa626573ac80baa99c4dae68.exe windows:4 windows x86 arch:x86
df219d897c1f0348cf6d1518a143d5d1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
LockResource
FindResourceA
GetModuleHandleA
GetStartupInfoA
lstrcpynA
IsDBCSLeadByte
advapi32
RegOpenKeyExA
RegEnumValueA
gdi32
TextOutA
GetTextExtentPoint32A
mfc42
msvcrt
__p__fmode
_except_handler3
__set_app_type
_onexit
_mbscmp
__dllonexit
_initterm
_exit
__getmainargs
__p__commode
__setusermatherr
_adjust_fdiv
_controlfp
_strnicmp
time
_setmbcp
exit
realloc
strtol
malloc
free
calloc
_snprintf
strncpy
atoi
fopen
fprintf
fclose
__CxxFrameHandler
_XcptFilter
_acmdln
memmove
shell32
ShellExecuteA
user32
GetParent
SetCapture
SetCursor
CreateCursor
PtInRect
ReleaseCapture
KillTimer
ScreenToClient
LoadIconA
GetDlgItem
CopyRect
GetSysColor
FillRect
InvalidateRect
EnableWindow
PostQuitMessage
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
GetSystemMenu
AppendMenuA
SendMessageA
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE