Behavioral task
behavioral1
Sample
Recuvaa.exe
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
X(.pyc
Resource
win11-20240221-en
General
-
Target
Recuvaa.exe
-
Size
81.9MB
-
MD5
d45d4c2cbc851597fd6443f4b1a8f3e8
-
SHA1
fcf7b5fd5937d2eebe36e3f7ba58e7e0aba9cbab
-
SHA256
56737e4f26e41c8d5aacb664385ed50bccc91085596d21eedf89a6c4e2aee3d8
-
SHA512
ce23594062c0b1433565f00189589e6151f47c6c87ed327c4be10c391e88cd06fe92568a51238eb9fccb6dbaa1c467462d8074dbb581a0e7c0bf7463a28010ce
-
SSDEEP
1572864:1U6PU1e4iamkhLDyPlfQuZuDznqf3Gd6xdnj+Y/5szPyE7KuZti6vW7qZV2WA:1U64e4iadhLDy9fVIDznyo6V/M+uvTvO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Recuvaa.exe
Files
-
Recuvaa.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 228KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 127KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
X(.pyc