Behavioral task
behavioral1
Sample
c9fa07c034b26845d029b9458d8382a597141c002e0ac44e01ed70657f21385d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c9fa07c034b26845d029b9458d8382a597141c002e0ac44e01ed70657f21385d.exe
Resource
win10v2004-20231222-en
General
-
Target
c9fa07c034b26845d029b9458d8382a597141c002e0ac44e01ed70657f21385d.exe.compressed
-
Size
442KB
-
MD5
a43fb0afddb6b43976be4bd24135e5b1
-
SHA1
3877940466bf8fa435f8af37e4d421c8b5f8ab41
-
SHA256
cec395140eb3ad89706b0cbef710e0a215f70433d8c65962295c7e30b02ee0d4
-
SHA512
84da9f892289062dcb259fc2737e46115c8c4640ed8353858714beaf57de502e4afa02b8efc524d58aa5ec9f91b6a70d2a43c6a2edbe4379e129217a82fa2fc4
-
SSDEEP
3072:hFHCuFdjX3nEnZjLo3ChirBtRix4wBblxgNuhPXHrJTkzlLH0vxsaJAQJkkVfoxC:biMjX3En9o3Chide4wlP5HrJTBpe4wV
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule static1/unpack001/out.upx INDICATOR_SUSPICIOUS_GENRansomware -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource c9fa07c034b26845d029b9458d8382a597141c002e0ac44e01ed70657f21385d.exe.compressed unpack001/out.upx
Files
-
c9fa07c034b26845d029b9458d8382a597141c002e0ac44e01ed70657f21385d.exe.compressed.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 592KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 253KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 85KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ