Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231222-en
General
-
Target
tmp
-
Size
2.6MB
-
MD5
f766f0dbbc035dfe0cff2a979ca4ebf0
-
SHA1
d4b379a2d8e6ae122fde78e1485a3e5772ab95d3
-
SHA256
85599b877e5e909709197d41a6081bf251a7e959452be505c82d34727036649b
-
SHA512
b60044921a81ed46d9bff0fff6fc52a24c19de286f440b3e8dab2f8cb2a37878b50c35f1c06442257e4bf62a7366e3a477eecc83c0082361fc53fe49a014fb0b
-
SSDEEP
49152:y8C3m/nK02r4vuf2KznOOCE1d4lJmSQhvw5FTgYBx/CvwnD3J2GrT3WDGT9+yH2q:dpQ+slxRSQ8gYBNC4DZh/GDU9+yWhJnN
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE