Behavioral task
behavioral1
Sample
5be1871510f6b086ae520277e2744cbc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5be1871510f6b086ae520277e2744cbc.exe
Resource
win10v2004-20231215-en
General
-
Target
5be1871510f6b086ae520277e2744cbc
-
Size
95KB
-
MD5
5be1871510f6b086ae520277e2744cbc
-
SHA1
29a3070b5066d0005bf8b40f83ad1999a9748ec7
-
SHA256
0ab4dce2babd144dfe70a92115aa464dc8afab9599317405cdc34abd61e1b5b3
-
SHA512
7131794fc4afedaf042ed9a8e7f2c728b003705f9d81cc5654fe30b590e19ffe67d96d68956a4ed783b7cfb29a938afadb65539491cc3a65570aed21e2cf9bb3
-
SSDEEP
1536:74T3s9yIPohs2koPT9ygMNwZPSN06xKYnr:74T3wPohGmSN06Pnr
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5be1871510f6b086ae520277e2744cbc
Files
-
5be1871510f6b086ae520277e2744cbc.exe windows:4 windows x86 arch:x86
9c73298337dc1ab340c21cb34fc5858b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
CreateThread
CloseHandle
GetModuleFileNameA
GetLastError
Sleep
LCMapStringW
LCMapStringA
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
SetStdHandle
CreateFileA
SetFilePointer
ReadFile
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
UnhandledExceptionFilter
FlushFileBuffers
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
advapi32
SetServiceStatus
StartServiceCtrlDispatcherA
StartServiceA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegisterServiceCtrlHandlerA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
ws2_32
Sections
UPX0 Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE