Behavioral task
behavioral1
Sample
Evernote.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Evernote.exe
Resource
win10-20240404-en
General
-
Target
Evernote.exe
-
Size
316KB
-
MD5
d437e9aa9dc1fb35ed180621a24c71a6
-
SHA1
7b067522fa8bca28908b2dec235d506151dad201
-
SHA256
31069de86e714a98732b4a3865d4e2275f2883f48d974facb86a9a4497a4ff6d
-
SHA512
27cecf191248e6bc950cae51f5720dcb9463ec0a52daedfb8d7599b9cb19c8625c1c5629206f1cbe56f2d21022147e017be49e1746975078a442a162b31382b8
-
SSDEEP
3072:XQ8rXzjK/Bc4HGRaZULEj0kYqZEV/T5qQP7E0UUCABpjfGyA3vAf93mDvr:XQkcG4HGoZULi0eZEqS7imVAfAhm
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Evernote.exe
Files
-
Evernote.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ