DiskSectorIO
GetPhysicalDriveHandle
GetPhysicalDriveNumber
SCSISectorIO
SetDriveLetterToEFI
Behavioral task
behavioral1
Sample
MBR_Experiment_No.1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MBR_Experiment_No.1.exe
Resource
win10v2004-20240226-en
Target
MBR_Experiment_No.1.exe
Size
81KB
MD5
68d21e42ba35dc6324c75da71233ea14
SHA1
f5c5c50336d9239e1765bd1f8ca50d9c3c27612f
SHA256
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2
SHA512
e76a537f59ad2230f646e050e2217667019f6656243ece09fdf0f834a84b5b02f643ad25fc3b92a17409de6928d308ed70cbb521c4b0037c6e60b7ec04687b0b
SSDEEP
1536:qn/9ecG8JnbijvBWya/1wpdN2YWL2MRxisBELCjTV1ExZ47pVUdsRGhSF:q/MPCbMvI9idspL2grTye7rUM
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
MBR_Experiment_No.1.exe |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
DiskSectorIO
GetPhysicalDriveHandle
GetPhysicalDriveNumber
SCSISectorIO
SetDriveLetterToEFI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ