Behavioral task
behavioral1
Sample
RemoveWGA.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RemoveWGA.exe
Resource
win10v2004-20240226-en
General
-
Target
bdcfd0dbc01149182020cda764b207d9
-
Size
17KB
-
MD5
bdcfd0dbc01149182020cda764b207d9
-
SHA1
1adc74a625d49f55160c2f652aa5c8eec5df2468
-
SHA256
e1bf85011b61d2d16fe1f4dd055050064d65a330cc199361531ec37a4ced765a
-
SHA512
d5edce3618e616cd5717d0c37d525b3faa2ab04c4c769aeb52b290aad4b43aec27862af0c5785015a77535bdadfb529929330df55c841606755dc2d308564830
-
SSDEEP
384:iXWqv2gjDIwGiCqUOHJ52DDlhClr0LHhTvGumzzO3Curlv0pukeS:iXhle4UhKrgTOuTCu0reS
Malware Config
Signatures
-
resource yara_rule static1/unpack002/RemoveWGA.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/RemoveWGA.exe unpack003/out.upx
Files
-
bdcfd0dbc01149182020cda764b207d9.eml
-
http://odnoklassniki.km.ru
-
-
RemoveWGA_1.2.rar.rar
-
RemoveWGA.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.code Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 11B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.flat Size: 1024B - Virtual size: 557B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
email-plain-1.txt