Behavioral task
behavioral1
Sample
5ac36f2a2fd0527f4033085a6986143c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5ac36f2a2fd0527f4033085a6986143c.exe
Resource
win10v2004-20231215-en
General
-
Target
5ac36f2a2fd0527f4033085a6986143c
-
Size
87KB
-
MD5
5ac36f2a2fd0527f4033085a6986143c
-
SHA1
88bf766a784a2c98d8cbd69869e27ee23a0293f7
-
SHA256
20011da6e2e2f2b4b2f727bd83b0269f33e159b97f177667cea7fd3f2a3a39c5
-
SHA512
aeba847caf7909288093f386602c4f4cb89a2e33f902bbb575580cf664541890463228db5a69f9ad816a1007351621c9c8789f7d673b27b2605bc816a23fccb1
-
SSDEEP
1536:tCZ9d6A2y9yU+g6hZZU1WGLGTQ5gUeHPlNB9o8FiUn2:te9d8g167gWGhevl79o8F9n2
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ac36f2a2fd0527f4033085a6986143c
Files
-
5ac36f2a2fd0527f4033085a6986143c.exe windows:4 windows x86 arch:x86
d893e031b907b293d544fd016c08c528
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
SizeofResource
FindResourceA
DeleteFileA
WaitForSingleObject
WinExec
GetCurrentProcessId
CopyFileA
TerminateProcess
OpenProcess
GetModuleFileNameA
LockResource
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
LCMapStringA
GetStringTypeW
GetStringTypeA
SetEndOfFile
GetOEMCP
LoadLibraryA
GetProcAddress
GetTempPathA
Sleep
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetLastError
ReadFile
GetCurrentProcess
SetFilePointer
HeapFree
WriteFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
SetStdHandle
FlushFileBuffers
HeapAlloc
VirtualAlloc
HeapReAlloc
CreateFileA
MultiByteToWideChar
GetCPInfo
GetACP
LCMapStringW
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyExA
user32
GetWindowTextA
GetClassNameA
PostMessageA
EnumThreadWindows
Sections
UPX0 Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE