Behavioral task
behavioral1
Sample
34fc63483d01d64ec6f99ab7a01d596dffa434c7a696ee5f27b3896685bb4b94.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
34fc63483d01d64ec6f99ab7a01d596dffa434c7a696ee5f27b3896685bb4b94.exe
Resource
win10v2004-20240226-en
General
-
Target
34fc63483d01d64ec6f99ab7a01d596dffa434c7a696ee5f27b3896685bb4b94
-
Size
840KB
-
MD5
8e85d4d3d5bf7152bcd8b6e66bf22587
-
SHA1
2f172efd0ec234da37651596bab0ddfc09c72189
-
SHA256
34fc63483d01d64ec6f99ab7a01d596dffa434c7a696ee5f27b3896685bb4b94
-
SHA512
11bef014f881d50aabda7a13ac09ff0ed30b1538dc2db24ebd2043677881dd7835c228a12c3a74915817f18c286fc8d0db8594f789548e7951069444d3cb60c2
-
SSDEEP
12288:z5/KLTynsHw1MaRvSi58xffGBomd4drcIyxDKlJq885J65nhOEsVKk/S/0nZVLpL:zrRJ2fGBHyylw825KnZQGz
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 34fc63483d01d64ec6f99ab7a01d596dffa434c7a696ee5f27b3896685bb4b94 unpack001/out.upx
Files
-
34fc63483d01d64ec6f99ab7a01d596dffa434c7a696ee5f27b3896685bb4b94.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 775KB - Virtual size: 776KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 334KB - Virtual size: 334KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ