Behavioral task
behavioral1
Sample
cr-piriform.exe
Resource
win11-20240221-en
General
-
Target
cr-piriform.exe
-
Size
440KB
-
MD5
5ddc3474f5a1a20b33db76a83818518b
-
SHA1
3e1014cd25ea3d7274ed2c8e2c8690b2400db81b
-
SHA256
99f0875ce316761fe9dde48b1313486ba59e257f2db08d8040bee5b07067010c
-
SHA512
2fa027d0a3d30d843337676d90a911a45f0e55620d951f12f1849a7d476783c4d20169fb1e5b85e8658b9607da0936aa2d2b609c68c4dccdfb5be232d7774309
-
SSDEEP
12288:JL9jNy/nNFGshtYpG61yX1ri4rCmdjsKmF8H0aX:dAX5upkX1+4rrdAKmF8H
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cr-piriform.exe
Files
-
cr-piriform.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 180KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 431KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE