Behavioral task
behavioral1
Sample
ce5d126c2ec82f0dd68abebe6bba950b39967ac30368f6c05592dd59b7d052ae.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ce5d126c2ec82f0dd68abebe6bba950b39967ac30368f6c05592dd59b7d052ae.exe
Resource
win10v2004-20231215-en
General
-
Target
ce5d126c2ec82f0dd68abebe6bba950b39967ac30368f6c05592dd59b7d052ae
-
Size
343KB
-
MD5
a680483402f06ef0635b44b0e55d067a
-
SHA1
d1a6be13ec991629f90c4a9b07010265a03b716e
-
SHA256
ce5d126c2ec82f0dd68abebe6bba950b39967ac30368f6c05592dd59b7d052ae
-
SHA512
f7e7617a8cfe3939443c77f852c8b6ae5be9b810e2b0e6ba2bcb949b1ebe97864994fb3208fac8a7514e6f0c40fb063a216904f21665d24436d2aa930f8299f6
-
SSDEEP
6144:gjluQoS3Io5Rsibl4r5sKHG5EquywbFAGirdOO9szGyoqHiO04EzG+BtGUlYPz:gEQoShxur51mobFNirdGMqHiOtUlI
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce5d126c2ec82f0dd68abebe6bba950b39967ac30368f6c05592dd59b7d052ae
Files
-
ce5d126c2ec82f0dd68abebe6bba950b39967ac30368f6c05592dd59b7d052ae.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gtcl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kxvu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.psfx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oncez Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bsp Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ