Behavioral task
behavioral1
Sample
M$TempSpoofer.exe
Resource
win10v2004-20231215-en
General
-
Target
M$TempSpoofer.exe
-
Size
84.7MB
-
MD5
53db03cc7114833f35d11ad535165db3
-
SHA1
87bc233b5fbcd05ba121d4f8ae467b969f4c9bb6
-
SHA256
c52cea591c593eedaacfb268bc2683a40012ad098c7908205d4abd23bfca18e4
-
SHA512
4435da3cf86efd7558691fd2e14ce8e3ed2c2684d358b0e1d4598a31ce5c37bf7687d5b68d87f4c1c2859210c30f3130da7421775cfe8af341ee87742f8035e3
-
SSDEEP
1572864:SUXPU1e4iamkhLDyPl4QiZeznqf3Gd6xdnj+Y/5szRd9ME7bZNRW79SRAoUQ:SUX4e4iadhLDy943sznyo6V/s917Rk9K
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource M$TempSpoofer.exe
Files
-
M$TempSpoofer.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 228KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 127KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
R$.pyc