Behavioral task
behavioral1
Sample
d797cc1d595ef8b46bea8f35b71b6d82.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d797cc1d595ef8b46bea8f35b71b6d82.exe
Resource
win10v2004-20240226-en
General
-
Target
d797cc1d595ef8b46bea8f35b71b6d82
-
Size
30KB
-
MD5
d797cc1d595ef8b46bea8f35b71b6d82
-
SHA1
51ba489001fc133c2c628110e0a77b5abc596f7f
-
SHA256
02ae92b2c69c2c3dbce2426fb0635859bdcd68699d33a168f7631e4ca4f394c3
-
SHA512
5ccc628b0e46ab4359a3d2d9c05c3b0e6a5081f01cfb64ffdbee65f76d32bd87feba9eb0c3ee81bd157c4d7a44dd5cd83f98b918bf88ab231b3453e24a90f345
-
SSDEEP
384:1imbXlwPrh7bR5UPKP57JF3pAgEBw+Dax:1im0vDUPKPRJFZAgExDax
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d797cc1d595ef8b46bea8f35b71b6d82
Files
-
d797cc1d595ef8b46bea8f35b71b6d82.exe windows:1 windows x86 arch:x86
e4bc731f05128923ce1d1acc68cff38f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetCommandLineA
GetComputerNameA
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
CloseHandle
GetTempPathA
GetTickCount
GetVersionExA
GetWindowsDirectoryA
CopyFileA
OpenMutexA
RtlUnwind
CreateFileA
Sleep
WriteFile
CreateMutexA
lstrcmpiA
CreateThread
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
crtdll
__GetMainArgs
_stricmp
atoi
exit
memset
raise
rand
signal
srand
strcat
strchr
strcmp
strncpy
strstr
strtok
shell32
ShellExecuteA
user32
wsprintfA
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
wsock32
WSACleanup
WSAStartup
closesocket
connect
htons
inet_addr
recv
send
socket
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE