Behavioral task
behavioral1
Sample
7f3d751902cf6b91d1205d3c1416db82.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f3d751902cf6b91d1205d3c1416db82.exe
Resource
win10v2004-20231215-en
General
-
Target
7f3d751902cf6b91d1205d3c1416db82
-
Size
282KB
-
MD5
7f3d751902cf6b91d1205d3c1416db82
-
SHA1
83a6a648881dfdcb1527db9a3d0075885900f1fe
-
SHA256
e58579e5bb02610d0934b61849c8d76da2211d1f9ed02ec9d2c108f19e1cc1f1
-
SHA512
a363ac01d171a7fac2b9e649fce535c91f5662a86294f039213ffe1548ab48c1f391a6107f200ab3ba5ec905547b598c20c37fc2df5413cde1c6bf8a310230b0
-
SSDEEP
6144:7Zw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:tFTxWYMh5qoLb8LCy9E
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f3d751902cf6b91d1205d3c1416db82
Files
-
7f3d751902cf6b91d1205d3c1416db82.exe windows:4 windows x86 arch:x86
913a4a367a3cc426f8f8ac8fe6743a43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetSystemDirectoryA
GetVersion
GetVersionExA
GetWindowsDirectoryA
InitializeCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
Sleep
lstrcmpiA
LoadLibraryW
GetProcAddress
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
wsock32
ioctlsocket
inet_addr
comdlg32
GetOpenFileNameW
user32
DestroyIcon
GetSystemMetrics
LoadIconA
PostMessageA
SetFocus
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocStringLen
SysFreeString
scecli
SceStartTransaction
SceGetDatabaseSetting
InitializeChangeNotify
SceRollbackTransaction
SceDcPromoCreateGPOsInSysvolEx
SceAddToNameStatusList
SceSetupUpdateSecurityFile
SceGetObjectChildren
SceIsSystemDatabase
SceEnforceSecurityPolicyPropagation
SceWriteSecurityProfileInfo
advpack
ExtractFiles
OpenINFEngine
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Y Size: 512B - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qvae Size: 4KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T Size: 2KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 139KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tiFp Size: 512B - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aqJji Size: 3KB - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ