Behavioral task
behavioral1
Sample
79ee1f2657ac5a6f5128ec7eec2cb8ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79ee1f2657ac5a6f5128ec7eec2cb8ff.exe
Resource
win10v2004-20231215-en
General
-
Target
79ee1f2657ac5a6f5128ec7eec2cb8ff
-
Size
47KB
-
MD5
79ee1f2657ac5a6f5128ec7eec2cb8ff
-
SHA1
43f3b32ba9c9c649abeeceec3c25f6d8274615b4
-
SHA256
7e41b80fef6e2da576c504557d3c13aecd815e94acb11a5506844afe21e59da5
-
SHA512
588bb6219961cff3d0f6424cebebdd621ee6db308f691b03d0282852f45d7260d889c2e4958da2a81cbd6922b1b565613c41afb8f085206f62a1b55d14e8940e
-
SSDEEP
384:pRdCy/MqlWKmQmDNSNDwWiRIOu95XihdvEPd8QL:hCy0ql7mQ0INiT2z
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79ee1f2657ac5a6f5128ec7eec2cb8ff
Files
-
79ee1f2657ac5a6f5128ec7eec2cb8ff.exe windows:4 windows x86 arch:x86
035f26bc3d14a926b3fa6f5d38d28f85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WinExec
TerminateProcess
OpenProcess
GetProcAddress
GetModuleHandleA
FindNextFileA
FindFirstFileA
FindClose
CreateFileA
CompareStringA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
urlmon
URLDownloadToFileA
user32
SendMessageA
PostMessageA
GetWindowTextA
GetDesktopWindow
FindWindowExA
FindWindowA
GetKeyboardType
MessageBoxA
Sections
UPX0 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE