Behavioral task
behavioral1
Sample
19ec09102ee612c7a7d7c42d3a4639e56f93ac0f313552612105a41d83560bb2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
19ec09102ee612c7a7d7c42d3a4639e56f93ac0f313552612105a41d83560bb2.exe
Resource
win10v2004-20240412-en
General
-
Target
19ec09102ee612c7a7d7c42d3a4639e56f93ac0f313552612105a41d83560bb2
-
Size
756KB
-
MD5
a6f48feaeb17a379c5768019ea89e101
-
SHA1
0e1637a81120d8072bf227cac5512cd841a43d2d
-
SHA256
19ec09102ee612c7a7d7c42d3a4639e56f93ac0f313552612105a41d83560bb2
-
SHA512
a1285521b7e340d9882c6a3897f2cb4a297d993e5595992bf40dd23b6c39f92d22986932b19a5d4bf6bfa2f8dde936bba7689ad0b5d9f0e47f880e71ea9e5f04
-
SSDEEP
12288:7EQoSaqhDQlbxa7ddnMiTz4z1O0GNlNNZ5+443W89CdiKDjKNsoNQeSKQvnRGICv:7rkta7dX321OxlNf5+P3v9C0KS/N6Kl9
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19ec09102ee612c7a7d7c42d3a4639e56f93ac0f313552612105a41d83560bb2
Files
-
19ec09102ee612c7a7d7c42d3a4639e56f93ac0f313552612105a41d83560bb2.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.btnj Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.s Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gduz Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.e Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fbe Size: 512B - Virtual size: 4KB