Behavioral task
behavioral1
Sample
7977167325d54acb6f41aa3a88433d64.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7977167325d54acb6f41aa3a88433d64.exe
Resource
win10v2004-20231222-en
General
-
Target
7977167325d54acb6f41aa3a88433d64
-
Size
339KB
-
MD5
7977167325d54acb6f41aa3a88433d64
-
SHA1
1494f7895f1226d992db83b0bede2be4f921ee40
-
SHA256
7165b5ffd9144bc89018b7fa741096b29c628e173f6e4ed6ae697ae9ceb7996f
-
SHA512
8fb34b083f1d8c540f971aaf671130e24c037f777ebcf35b3b00daf542809aa9ccc3624b29bd0d0ff4dc8f4661bbc263ab424fff91246f6adebbc8b34564d09b
-
SSDEEP
6144:aLEchZLsu1AcKKIFrMg3p/UHLEhtfwjH5fc1zdLThGniSRxixV4naNiEGoZSKaUD:ZiZLn1SKIFlUHLEk75UJdcniSRxuV4a7
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7977167325d54acb6f41aa3a88433d64
Files
-
7977167325d54acb6f41aa3a88433d64.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 268KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 333KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE