Behavioral task
behavioral1
Sample
15992bf8ef39c4874cf20e762323007508b8d370e773085a309bd1ee9a7f7e3a.exe
Resource
win7-20240221-en
General
-
Target
15992bf8ef39c4874cf20e762323007508b8d370e773085a309bd1ee9a7f7e3a
-
Size
586KB
-
MD5
f0dabf90e01cdfabf965d7e8ec341e0f
-
SHA1
b56d0c614d314b45f0605022436be9032e12a3ec
-
SHA256
15992bf8ef39c4874cf20e762323007508b8d370e773085a309bd1ee9a7f7e3a
-
SHA512
fe89e40b4031d0bb8b9d10d7f4911d00e390e014c4ed8583216f3ff508712afed8020b9003d1df57deb001fa2b9343d10fa24142954713a168b44fab3d21ae7a
-
SSDEEP
12288:T1RDzeOfFUWDwQSkRFRGWU3UwQYIJOPMk+Fw7s:T1RX3w1k/XUfGPkFs
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Urelas family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15992bf8ef39c4874cf20e762323007508b8d370e773085a309bd1ee9a7f7e3a
Files
-
15992bf8ef39c4874cf20e762323007508b8d370e773085a309bd1ee9a7f7e3a.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 346KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE