Behavioral task
behavioral1
Sample
ec362244484e439eb66249da80d9f9932b663465b1e2c74d5465fe6cad29fccf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ec362244484e439eb66249da80d9f9932b663465b1e2c74d5465fe6cad29fccf.exe
Resource
win10v2004-20240226-en
General
-
Target
ec362244484e439eb66249da80d9f9932b663465b1e2c74d5465fe6cad29fccf
-
Size
156KB
-
MD5
2b7ecb794aa14a79431dbd3b23ba60f8
-
SHA1
8d4868208975caae91193cc90b6fff7ebdba1e9a
-
SHA256
ec362244484e439eb66249da80d9f9932b663465b1e2c74d5465fe6cad29fccf
-
SHA512
913239351c0d4a3ac3f8a4b0e410e4752aa271e62370c123b8df171a549f1ebafbdfaba03c4756545ea1af2f7c34f3eb1729e29ec505ea2f2b8d7e722dd04826
-
SSDEEP
1536:Bj61DwUvyK+twm87HjWtg9VW1wUDrv3jDHffOwiZOc:4xvyJwUtg9AHnOf5
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec362244484e439eb66249da80d9f9932b663465b1e2c74d5465fe6cad29fccf
Files
-
ec362244484e439eb66249da80d9f9932b663465b1e2c74d5465fe6cad29fccf.exe windows:4 windows x86 arch:x86
e132f96d24e87c36c017d848af520cac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
HeapCreate
GetCommandLineA
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
HeapDestroy
ExitProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
PeekNamedPipe
TerminateProcess
GetExitCodeProcess
SetUnhandledExceptionFilter
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTempPathA
SetFileAttributesA
DeleteFileA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
comctl32
InitCommonControlsEx
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
strcpy
strcat
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
tolower
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
shlwapi
PathRemoveArgsA
PathGetArgsA
PathAddBackslashA
PathQuoteSpacesA
PathUnquoteSpacesA
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
winmm
timeBeginPeriod
Sections
UPX0 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE