Behavioral task
behavioral1
Sample
bc6b7f725f387e81b5597adf2b44691e.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bc6b7f725f387e81b5597adf2b44691e.exe
Resource
win10v2004-20240226-en
General
-
Target
bc6b7f725f387e81b5597adf2b44691e
-
Size
176KB
-
MD5
bc6b7f725f387e81b5597adf2b44691e
-
SHA1
2dc755fe4270cdc3b3d28151dc537d47f20ae19c
-
SHA256
b82c2c3621a6a8db4b14f32a9f30b12b2bcefbc9fe926ac0939abcb2f05e240f
-
SHA512
37527d2c2c2988fe9ff5fcc5b94cbd1b334c78e5e79f4ff58dc7bbb45daa9b7f3afea4ceff5a2c8a6f80bca2a6fd84dfd7fdcfe6d746d974ba27e75988a15746
-
SSDEEP
3072:FWR3IO9UUW/7lGuXCkaTxDA6vnfGO7HuB/h9hPr2PxTwBSup0Zj0QR:ER4OlW/7t0FDAenPOrPr2pwcuaZjdR
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
bc6b7f725f387e81b5597adf2b44691e.exe windows:4 windows x86 arch:x86
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After01/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US25:c9:6d:58:49:e4:5f:2f:97:c6:01:34:8b:ae:39:00Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before26/01/2010, 00:00Not After26/01/2011, 23:59SubjectCN=Widebiz,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Widebiz,L=Haeundae-gu\ ,ST=Pusan,C=KRExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
e3:1c:c4:58:a3:b0:10:ec:24:87:f6:05:70:c8:51:3b:55:b9:c2:a5Signer
Actual PE Digeste3:1c:c4:58:a3:b0:10:ec:24:87:f6:05:70:c8:51:3b:55:b9:c2:a5Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 416KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 165KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 276KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ