Behavioral task
behavioral1
Sample
96d0e1320407069dd80855a54cb94103.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
96d0e1320407069dd80855a54cb94103.exe
Resource
win10v2004-20231215-en
General
-
Target
96d0e1320407069dd80855a54cb94103
-
Size
80KB
-
MD5
96d0e1320407069dd80855a54cb94103
-
SHA1
97873320260797a2b7f07c383ff6d486c710aa1c
-
SHA256
720160ffee48b22fc515aa584821cacd967dc76e88490899d2dbb1b39647ae6e
-
SHA512
c53b46b4b6b8b22e3b0f92c73a73fcf988241a65b4d34d7f5cde0fd601de53a31c55af921c8e5d60a5c9f8fe66e248d5361c6a718a97d2d9a39fdae174e0af75
-
SSDEEP
768:1uaqAVszGu8QfFrq1MhdiqqtITB0CjV05kRm64cKp2:YaqAVsT9O12ijU0d6j
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96d0e1320407069dd80855a54cb94103
Files
-
96d0e1320407069dd80855a54cb94103.exe windows:4 windows x86 arch:x86
1750117d8cd0c6264be3e88afc0707f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WritePrivateProfileStringA
SetFilePointer
ReadFile
GetWindowsDirectoryA
GetVolumeInformationA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetFileAttributesA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetCurrentThreadId
GetStartupInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegCreateKeyA
RegCloseKey
GetUserNameA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
rasapi32
RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA
user32
MessageBoxA
CharLowerBuffA
GetKeyboardType
MessageBoxA
Sections
UPX0 Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE