Behavioral task
behavioral1
Sample
BAICLEAN.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
BAICLEAN.exe
Resource
win10v2004-20231215-en
General
-
Target
8a18bde5381599a936455aa8514b2a2b
-
Size
291KB
-
MD5
8a18bde5381599a936455aa8514b2a2b
-
SHA1
0079603f21f1e004b5a8d71997f7fd2894dca975
-
SHA256
e54ad3c567ae72da230b21bc826769df8fb9358e9363b4f14b5fd4397fcd0ca0
-
SHA512
04711463d22fab002367a77aae0bb731f32922ce489a0ab8b633ac374059a49cdec5c1b8b972310febbca243868fbf50be0a0048bb3ea39526d6e7160c80ae5a
-
SSDEEP
6144:rq348U3MYr5IiH4FaokgKAnrLF2TdugzYJzUzuL:rq346e4S+nrLF2TduIYJl
Malware Config
Signatures
-
resource yara_rule static1/unpack001/BAICLEAN.EXE aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BAICLEAN.EXE
Files
-
8a18bde5381599a936455aa8514b2a2b.zip
-
BAICLEAN.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 213KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pmonti Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
BAICLEAN.EXE.sig