Behavioral task
behavioral1
Sample
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe
Resource
win10v2004-20240319-en
General
-
Target
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41
-
Size
400KB
-
MD5
36d853f24b792a3f001764aca709ffbf
-
SHA1
f59b2a48e08a471a866d4f7b419da04197436b73
-
SHA256
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41
-
SHA512
03d82cd684eebb96537d9acb8e1cef368fb8b54e6af98f39f2745771cdf6f76e33dae1b96759f9adf28f455e0fe9281202c56e350000cb3141c16798f51b593f
-
SSDEEP
3072:uDxELd9sXbq+FziQ5foIY8RdMyFqhVw09wF3AbuXijGVB60Enddmzwh2HNw7XR:axELvswQloIY2vcVT9IwciKHEDmzKy+
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41
Files
-
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe windows:5 windows x86 arch:x86
0a69965e7dfdd919b0cfc8ddd8e9d2f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceW
GetCommProperties
GetModuleHandleW
GetVersionExW
lstrlenW
LocalAlloc
WaitForMultipleObjects
GetProcessAffinityMask
VirtualProtect
PurgeComm
EnumSystemLocalesW
IsBadHugeReadPtr
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
HeapSize
SetFilePointer
PeekNamedPipe
GetComputerNameA
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
RtlUnwind
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
gdi32
EndPath
SetDCBrushColor
user32
OemToCharW
DdeAccessData
DefFrameProcA
GetClipboardFormatNameA
SetFocus
GetWindowPlacement
SetUserObjectSecurity
SetScrollPos
ShowScrollBar
EnableWindow
GetMonitorInfoW
Sections
UPX0 Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE