Behavioral task
behavioral1
Sample
98865ab5a3dc29c7238eda5d085416d1.exe
Resource
win7-20231215-en
General
-
Target
98865ab5a3dc29c7238eda5d085416d1
-
Size
181KB
-
MD5
98865ab5a3dc29c7238eda5d085416d1
-
SHA1
6ffb48814fa677a62b6fd41a363d6c6a2d5254d6
-
SHA256
ab37fe480fc64fd4f8e6ffc34a62ee3d9c6096f2a9987d541f3803798882c8b5
-
SHA512
3fb4e18c8b7f6b885f03e6142838fb6bf1c93f10bf635255ade3a4ec75976ba21b2e1835c55d57b1f3cb95c8500e2740ff053ba71f6e0e00fa1df7f0ce92f909
-
SSDEEP
3072:z/5KFl81i04l2Fv2f9tMUr6of9MRNwda7KVr0cHneunw1oN:z/5KFl81jDv72RFMReGir0cHneMwqN
Malware Config
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98865ab5a3dc29c7238eda5d085416d1
Files
-
98865ab5a3dc29c7238eda5d085416d1.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
POLSJDKW Size: 124KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
POLSJDKW Size: 55KB - Virtual size: 56KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE