Behavioral task
behavioral1
Sample
a40a8fa96a1b4107d0a68aeeaf98e14b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a40a8fa96a1b4107d0a68aeeaf98e14b.exe
Resource
win10v2004-20240221-en
General
-
Target
a40a8fa96a1b4107d0a68aeeaf98e14b
-
Size
632KB
-
MD5
a40a8fa96a1b4107d0a68aeeaf98e14b
-
SHA1
862266ede1a4701554723b0d85bf037f91af984e
-
SHA256
bb96bef871fab61214a8ecfabbfd25d7aab10c21c95841aaf03030ce3d22ed6d
-
SHA512
8f467f92c0d9c983f6400cc364da2d9d4dd844feca30923d0643da5622791cef6f3b3cebd7e84e9ce21db54d7d93502f4027967cccd5b541a6081a304d0874c5
-
SSDEEP
12288:3fzuaKnQO34E761TnBd+Ev1+JSDpC/xTaxRg:3fiCsz6lBok1DDpWxTaxa
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a40a8fa96a1b4107d0a68aeeaf98e14b
Files
-
a40a8fa96a1b4107d0a68aeeaf98e14b.exe windows:4 windows x86 arch:x86
91e85819d72d05b39aa8f72fc73d021f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
WaitForSingleObject
Sleep
SetFileTime
SetFilePointer
SetFileAttributesA
ReadFile
OutputDebugStringA
OpenProcess
OpenMutexA
MoveFileExA
LocalFileTimeToFileTime
GetWindowsDirectoryA
GetTempPathA
GetTempFileNameA
GetSystemDirectoryA
GetShortPathNameA
GetModuleFileNameA
GetFileAttributesA
GetCurrentProcessId
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
DosDateTimeToFileTime
DeleteFileA
CreateProcessA
CreateMutexA
CreateFileA
CreateDirectoryA
CopyFileA
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
oleaut32
SysFreeString
SysReAllocStringLen
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
user32
GetKeyboardType
MessageBoxA
CharNextA
CreateWindowExA
UpdateWindow
ShowWindow
SetWindowLongA
RegisterClassA
MessageBoxA
LoadIconA
LoadCursorA
GetWindowLongA
DefWindowProcA
Sections
UPX0 Size: 624KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE