Behavioral task
behavioral1
Sample
78d0a7193a68f6418658cd25309673ba.exe
Resource
win7-20231215-en
General
-
Target
78d0a7193a68f6418658cd25309673ba
-
Size
372KB
-
MD5
78d0a7193a68f6418658cd25309673ba
-
SHA1
45272dae52b705531664dbcfca22fd7e2187a4e0
-
SHA256
b9b544b6157319034f932e8a3297458f9d0a67198602df6640a5a49af4fcdeeb
-
SHA512
935650e598dadf443f0572d682ca4cfca795d0f3ac6ec0d8dd692814bfd0a1f1a2f17646f5f1c31645cb6d85d5d449fd43258bffa8ff846c3963bf3b850fd1c7
-
SSDEEP
6144:LdeSdYSR3UzRnfLSokPvVADEO8TBzpQjbg7M3zikMDjE:LES2SR3UzRnjSoCQEOCBzkJ3Wc
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78d0a7193a68f6418658cd25309673ba
Files
-
78d0a7193a68f6418658cd25309673ba.exe windows:4 windows x86 arch:x86
8c7660d5a124cb5becc9b9d698520fd7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetStringTypeW
GetStringTypeA
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
Sleep
WaitForSingleObject
SetEvent
GetModuleHandleA
GetTickCount
CreateEventA
GetLastError
CloseHandle
GetCommandLineA
CreateProcessA
WaitForMultipleObjects
LoadLibraryA
GetExitCodeProcess
HeapFree
HeapAlloc
ResumeThread
CreateThread
TlsSetValue
ExitThread
GetStartupInfoA
GetVersion
ExitProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
GetCurrentThreadId
TlsAlloc
SetLastError
TlsGetValue
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
user32
SetFocus
RegisterClassA
GetDesktopWindow
GetClientRect
CreateWindowExA
ShowWindow
UpdateWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
DefWindowProcA
BeginPaint
DrawTextA
EndPaint
LoadImageA
GetDC
ReleaseDC
LoadStringA
MessageBoxA
gdi32
RealizePalette
BitBlt
DeleteObject
SetTextColor
SetBkColor
SetBkMode
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBColorTable
CreatePalette
DeleteDC
CreateHalftonePalette
SelectPalette
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 224KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE