Behavioral task
behavioral1
Sample
b354d681bdbc74f3a305d985bc40496087a18e9b608248a8f11d0a19fcc4e59b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b354d681bdbc74f3a305d985bc40496087a18e9b608248a8f11d0a19fcc4e59b.exe
Resource
win10v2004-20240226-en
General
-
Target
b354d681bdbc74f3a305d985bc40496087a18e9b608248a8f11d0a19fcc4e59b
-
Size
37KB
-
MD5
6df22d8a390fa2d92b0f58edbd3c6091
-
SHA1
f84de4fb7f67d02b0a97bb7841a05aee06d0b11b
-
SHA256
b354d681bdbc74f3a305d985bc40496087a18e9b608248a8f11d0a19fcc4e59b
-
SHA512
6d8571f1d0aec7aa0784b7ebfcb6dac075d3686eddc1675a4e62dbf315dfa925eb0fdaf28ce3f9b985449f47511d8ea9985b404cf85a91a3449d5dd13c8fd5ec
-
SSDEEP
192:+RbZ9rSaoJ2+DBh5kIq5H8rzjR3OhkU2V6YFBx9xVF2UkuxDrt9GDTzLfr3:MZcaoPBXkIq5ozV/N4Yz+uFanfT
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b354d681bdbc74f3a305d985bc40496087a18e9b608248a8f11d0a19fcc4e59b
Files
-
b354d681bdbc74f3a305d985bc40496087a18e9b608248a8f11d0a19fcc4e59b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE