Behavioral task
behavioral1
Sample
ece168c9c20d823156407e06d92bdd8783b306827de64ffb07a435c1cbe7836c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ece168c9c20d823156407e06d92bdd8783b306827de64ffb07a435c1cbe7836c.exe
Resource
win10v2004-20240226-en
General
-
Target
ece168c9c20d823156407e06d92bdd8783b306827de64ffb07a435c1cbe7836c
-
Size
224KB
-
MD5
fc6fa8c4cdc6e2e042c6390a706d105c
-
SHA1
493bd4eab2366dffd280bf50e0adaba6f56cf484
-
SHA256
ece168c9c20d823156407e06d92bdd8783b306827de64ffb07a435c1cbe7836c
-
SHA512
609db57d727bcf83a1964b828f94f0d9ba11146a2a492345a7d44d244334c4ad135477df5395e2a37a913ad3a476192659a22d142c076568efdcdd42382f7a90
-
SSDEEP
1536:xR4fRkYXk/YLfftr2F8t9xMnOEJbQpplEqt6JVz1csWjcdbr32XdsKbe0+rB+HPh:xyf98YjR2F8HxMOEJbcDt6dbaXeWP4mL
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ece168c9c20d823156407e06d92bdd8783b306827de64ffb07a435c1cbe7836c
Files
-
ece168c9c20d823156407e06d92bdd8783b306827de64ffb07a435c1cbe7836c.exe windows:5 windows x86 arch:x86
17ad89cc2798ded62c13afc104f2bd33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
WideCharToMultiByte
GetFileType
GetStdHandle
LCMapStringW
WriteProcessMemory
CreateDirectoryA
LoadLibraryA
lstrlenA
GetProcessHeap
GetProcAddress
GetStringTypeW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
CreateFileW
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
WriteFile
GetModuleFileNameW
GetModuleFileNameA
MultiByteToWideChar
GetACP
HeapFree
HeapAlloc
OutputDebugStringW
CloseHandle
WaitForSingleObjectEx
CreateThread
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
gdi32
TextOutA
user32
DispatchMessageA
ShowWindow
CreateWindowExA
DefWindowProcA
PostMessageA
LoadStringA
LoadCursorA
LoadIconA
RegisterClassExA
GetMessageA
TranslateMessage
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
SetFocus
DestroyWindow
SendMessageA
wtsapi32
WTSLogoffSession
WTSEnumerateProcessesA
WTSWaitSystemEvent
WTSQuerySessionInformationA
Sections
UPX0 Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE