Behavioral task
behavioral1
Sample
ac0a06f00c4adaaefb274b5f4c03a0a2.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ac0a06f00c4adaaefb274b5f4c03a0a2.exe
Resource
win10v2004-20240226-en
General
-
Target
ac0a06f00c4adaaefb274b5f4c03a0a2
-
Size
128KB
-
MD5
ac0a06f00c4adaaefb274b5f4c03a0a2
-
SHA1
343d752dd193f07305930d4a44d39f57693d9db2
-
SHA256
3f95c918dca17f5fa2f4e4cfb94145d4a52a9276a1a96a2a929490cd4f9b29e7
-
SHA512
afccaf7621f75cdcf812167953b6d483f80e63e0ba64f39ccaf9da6a90fdd4c3188eab3eeebaa59efee7c5b09ea7a831ae049928b49ac88fc231652678722dd3
-
SSDEEP
384:K0+uJSLBroRvSXU2ShQy+uJS3mwDqyWi34hUrQXsbfc1pNdr0Qc9bHOQ0zv:wBgSkLhWqpi344B7ccYB
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac0a06f00c4adaaefb274b5f4c03a0a2
Files
-
ac0a06f00c4adaaefb274b5f4c03a0a2.exe windows:4 windows x86 arch:x86
01287885cd48a1111054de022fc7a96c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalUnlock
lstrcpyW
lstrlenW
GlobalLock
lstrcpynW
GlobalAlloc
GlobalFree
lstrcatW
MultiByteToWideChar
lstrcatA
lstrcpyA
Sleep
CloseHandle
ReleaseMutex
GetLastError
CreateMutexA
GetLocalTime
SetErrorMode
GetModuleHandleA
GetStartupInfoA
msvcrt
_initterm
_controlfp
__CxxFrameHandler
??2@YAPAXI@Z
rand
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_except_handler3
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
user32
GetClipboardData
SetClipboardData
OpenClipboard
CloseClipboard
EmptyClipboard
Sections
UPX0 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE