Behavioral task
behavioral1
Sample
tr.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tr.exe
Resource
win10v2004-20231222-en
General
-
Target
tr.exe
-
Size
3.9MB
-
MD5
451e69294a50364781d0901cbf80728e
-
SHA1
00b37a58c34e4c9e5f24ff78670785f1f6419e4a
-
SHA256
f192d7fd4309338df26353f8c9b3fd0e4e6f14354a9e0df5cc47a7605d3c7ba9
-
SHA512
d3330f8404da083c06ebb8f2b07702d7b8361e43bb5929d9ccf8db386f75a3684bafc8ba1b3d80729b4a8239c6c436360d93b27f01de6b4d29bb4abed8c006c2
-
SSDEEP
12288:UeuqZ0GO3/fTn5rPtFDO5BTVo2hZiavoQFNc6E4PUwgs:Mv3/fTLF671TilQFG4P5
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tr.exe
Files
-
tr.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE