Behavioral task
behavioral1
Sample
0127408bb3d9dee7affb6326b529ffd27e1f5c26a55143120dffaffb4324a9ce.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0127408bb3d9dee7affb6326b529ffd27e1f5c26a55143120dffaffb4324a9ce.exe
Resource
win10v2004-20240226-en
General
-
Target
0127408bb3d9dee7affb6326b529ffd27e1f5c26a55143120dffaffb4324a9ce
-
Size
1.6MB
-
MD5
fa0bc66caae6ca3e229b74980bdeea2a
-
SHA1
c6c248c888d5799d05b465727b62e6dbdc2731a0
-
SHA256
0127408bb3d9dee7affb6326b529ffd27e1f5c26a55143120dffaffb4324a9ce
-
SHA512
dff7cca464c38688a7214406fd3bdd9065c8cb82bf832a592a4eddeb7efeb2b4f2e4290a40f89de3d5518071796fd88377db7618a514fb00ff5cb70ad915b4ff
-
SSDEEP
24576:qFE//Tct4bOsJ61Tjz354jIIPZtqFdy6M56Pmc6v8XIDvU+WFpftNn2mMIRQ3pbf:ISV+5zMt8dyBcv6kYjU+WtPRKFd
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0127408bb3d9dee7affb6326b529ffd27e1f5c26a55143120dffaffb4324a9ce unpack001/out.upx
Files
-
0127408bb3d9dee7affb6326b529ffd27e1f5c26a55143120dffaffb4324a9ce.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 452KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 263KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ