Behavioral task
behavioral1
Sample
35bf4de20f4cab4f9c051d632c029ca8c8bfbcf7b595b8c9d778c640fdf2237b.exe
Resource
win7-20240220-en
General
-
Target
35bf4de20f4cab4f9c051d632c029ca8c8bfbcf7b595b8c9d778c640fdf2237b
-
Size
2.6MB
-
MD5
fba5a7e08e7e7851f948f8418ad22d53
-
SHA1
46d2f6b35c402d0c977ccd727c4f21fcf0eb4217
-
SHA256
35bf4de20f4cab4f9c051d632c029ca8c8bfbcf7b595b8c9d778c640fdf2237b
-
SHA512
c08f7fa561ab217e055bb83f6150be2421181c088d0601043c148a9631d022a05bd4be1909e963f00ecfde75672ad0022ccf2fa87f08e5a09fb8eed9ab790ab3
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd5wjTBU81q1daLPx:BemTLkNdfE0pZr7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35bf4de20f4cab4f9c051d632c029ca8c8bfbcf7b595b8c9d778c640fdf2237b
Files
-
35bf4de20f4cab4f9c051d632c029ca8c8bfbcf7b595b8c9d778c640fdf2237b.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE