Behavioral task
behavioral1
Sample
857e67cc52c06723bd05332d045733f7ea9e308d887e1c086bae841511cc6ec6.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
857e67cc52c06723bd05332d045733f7ea9e308d887e1c086bae841511cc6ec6.exe
Resource
win10v2004-20240226-en
General
-
Target
857e67cc52c06723bd05332d045733f7ea9e308d887e1c086bae841511cc6ec6
-
Size
2.1MB
-
MD5
1aa7b66e50ef9c3fac81ccb170cc9470
-
SHA1
9c60792fe2ddf61367982445152866cfa6ab820e
-
SHA256
857e67cc52c06723bd05332d045733f7ea9e308d887e1c086bae841511cc6ec6
-
SHA512
7840451f8a548eba363c792640a459fc1f71342d75f6ef5aa835e657fb05630c0fa62fddb148b3903a5ed0b3d18eae5db0e4a005794098e9e2965fcc173bfa99
-
SSDEEP
49152:KK7HDhBIcSdH8F17tbH4zFKeBIxUwvGv/:KK7HDhe8H7pwoG1f
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 857e67cc52c06723bd05332d045733f7ea9e308d887e1c086bae841511cc6ec6 unpack001/out.upx
Files
-
857e67cc52c06723bd05332d045733f7ea9e308d887e1c086bae841511cc6ec6.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 264KB - Virtual size: 646KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 409KB - Virtual size: 408KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ