Behavioral task
behavioral1
Sample
c8ca62ddcdb6fe65d291cb714ed963d1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c8ca62ddcdb6fe65d291cb714ed963d1.exe
Resource
win10v2004-20240226-en
General
-
Target
c8ca62ddcdb6fe65d291cb714ed963d1
-
Size
242KB
-
MD5
c8ca62ddcdb6fe65d291cb714ed963d1
-
SHA1
5d58b5e6e84a23b60c18e360ce11d51c5130b4d9
-
SHA256
5416f2a57966a02640dea1f40527d8a8ba976834f8648ae833e0ec08f30011e0
-
SHA512
6593857037c3e265837cd43c5a1de5a3e0ab5521db2aff177e056f3aacdf1c45d387f629c3f3325bdda041b5a2334f5a01d3566ea152f6e37f0a78b419f763f2
-
SSDEEP
6144:t6V/DOot4F0rTKW0VWWhvJ6GptscA+3iNXnKJ8HK5JCXM:eDOm4GTv/QMoW+3iNXKQKzCX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource c8ca62ddcdb6fe65d291cb714ed963d1 unpack001/out.upx
Files
-
c8ca62ddcdb6fe65d291cb714ed963d1.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 288KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 237KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 183KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 482B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ