General
-
Target
UserBenchMark.exe
-
Size
34.3MB
-
MD5
60522b5d150d17c3d9cfc7cabd8a9f91
-
SHA1
37881c79807833814fc21f93e84c8f165d0a89ef
-
SHA256
ad3235c49803e7a26c3efe5b75ccd92ab0504415c7ccc1d852f76ef1c83c1aad
-
SHA512
6034530c3a1045b4809c9271d32e2a7dbcd56242d86eaaa05c3581d89010a612888f750d53a3a3e85a86628654949d2082a8b611f30b0b1caf7370ecae836728
-
SSDEEP
786432:+3COl1zcpd/2VeIgJK2rXQrV6B3u47tz1Nw0hIiI+lqwrAPmLl:x+1zcbTRcIBp7trwWIibqwrAuLl
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UserBenchMark.exe
Files
-
UserBenchMark.exe.exe windows:6 windows x64 arch:x64
d1c1dbbd3f23a12ffe26914c72391cde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextA
CharUpperBuffW
advapi32
CryptReleaseContext
Sections
.text Size: 830KB - Virtual size: 830KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 231KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 777KB - Virtual size: 790KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 17.2MB - Virtual size: 17.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ