Static task
static1
Behavioral task
behavioral1
Sample
0ca1a7d21a7552e89c91fddeaa46045c99ffd7afdcd3c8ede6a76faa8bdd32c3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0ca1a7d21a7552e89c91fddeaa46045c99ffd7afdcd3c8ede6a76faa8bdd32c3.exe
Resource
win10v2004-20240226-en
General
-
Target
0ca1a7d21a7552e89c91fddeaa46045c99ffd7afdcd3c8ede6a76faa8bdd32c3
-
Size
4.6MB
-
MD5
454ea75bc46c13a5782ed4135e392146
-
SHA1
d99d3759f975bab499769e252630a47a1e947333
-
SHA256
0ca1a7d21a7552e89c91fddeaa46045c99ffd7afdcd3c8ede6a76faa8bdd32c3
-
SHA512
9ce50a273a3f786c34c6162cd7faf27e3a74a4bbd75845d96ab553c5966476fe8701db921ea986b5558642353a3e68a8eb190cc8f8595bb3c7b16f215fd52aca
-
SSDEEP
98304:9O1q0JOVBP4IvzVZlo039QNTC3vZsfMo/J52UYRBPJTuWMKOJm:Yq0JObPBZZlo0YwR
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ca1a7d21a7552e89c91fddeaa46045c99ffd7afdcd3c8ede6a76faa8bdd32c3
Files
-
0ca1a7d21a7552e89c91fddeaa46045c99ffd7afdcd3c8ede6a76faa8bdd32c3.exe windows:4 windows x86 arch:x86
10405e72e795d6ad6bd3e8988b4e3dd4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateSemaphoreW
DebugBreak
DeleteCriticalSection
EnterCriticalSection
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ScrollConsoleScreenBufferA
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleOutputA
msvcrt
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_errno
_filelengthi64
_fileno
_fstat64
_fstati64
_get_osfhandle
_initterm
_iob
_isatty
_kbhit
_lseeki64
_onexit
_stati64
_strnicmp
_vsnprintf
_wfopen
_wopen
abort
atoi
calloc
clock
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
gmtime
printf
putc
putchar
putwc
qsort
rand
realloc
rename
setlocale
setvbuf
signal
sprintf
srand
sscanf
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strrchr
strstr
strtol
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
time
wcscoll
wcsftime
wcslen
wcstombs
wcsxfrm
_write
_utime
_unlink
_stricmp
_strdup
_sopen
_setmode
_rmdir
_read
_open
_isatty
_fileno
_fdopen
_dup
_close
_chmod
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 14KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 392KB - Virtual size: 391KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/31 Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/45 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/57 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/70 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/81 Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/92 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ