Behavioral task
behavioral1
Sample
936d471214d546fc345de1153c8d26664c86d6f04f59d27cc3c179c60d0e4285.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
936d471214d546fc345de1153c8d26664c86d6f04f59d27cc3c179c60d0e4285.exe
Resource
win10v2004-20240226-en
General
-
Target
936d471214d546fc345de1153c8d26664c86d6f04f59d27cc3c179c60d0e4285
-
Size
157KB
-
MD5
f7da3df7cbd5ae9b27a8dcb24c9c2889
-
SHA1
20a327beb73547eee6d1123b3a93547b65b04568
-
SHA256
936d471214d546fc345de1153c8d26664c86d6f04f59d27cc3c179c60d0e4285
-
SHA512
215fd4d309d7cebc3a542cf13f78b882d6372e60a041c5087558da444076ff8a433bdede613054050f9472db60ce37068cf197e9f4d5545f290019d0b22b129a
-
SSDEEP
3072:WxA2Z9ed5OgrPWW4efRp2oCdWeiJtgUxohinuAtNJk6soIuv1BmLSl:WJ9ed5/ejeJpxCdstgUmZ6NR+uiU
Malware Config
Signatures
-
Detects executables packed with ASPack 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ASPack -
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 936d471214d546fc345de1153c8d26664c86d6f04f59d27cc3c179c60d0e4285
Files
-
936d471214d546fc345de1153c8d26664c86d6f04f59d27cc3c179c60d0e4285.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text5 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text4 Size: 143KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE