Behavioral task
behavioral1
Sample
212fb1b6b5a7e2d88adf651e0d84c77e5cb8b8303ac8e4ef006dd8d41656a189.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
212fb1b6b5a7e2d88adf651e0d84c77e5cb8b8303ac8e4ef006dd8d41656a189.exe
Resource
win10v2004-20240226-en
General
-
Target
212fb1b6b5a7e2d88adf651e0d84c77e5cb8b8303ac8e4ef006dd8d41656a189
-
Size
474KB
-
MD5
1f9997c22706ac5244858c53efd6c92e
-
SHA1
b7f98bd473418ac14a192a8b35c2b96a1498d54d
-
SHA256
212fb1b6b5a7e2d88adf651e0d84c77e5cb8b8303ac8e4ef006dd8d41656a189
-
SHA512
5854c92addeb7a75f9ce95ab72f3f78382fbe1d582efbb115e52ff5e9ddc844c75264c41e24a4f6e67cfad8319f8a093800c13ff5596ae9e35528f67ed25ecfb
-
SSDEEP
12288:gEQoSL36hAU2SEkg0GUkDrOqWxOTG917lwjj3gTO4xi:gSAUL1g0nQOICojjQTVxi
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 212fb1b6b5a7e2d88adf651e0d84c77e5cb8b8303ac8e4ef006dd8d41656a189
Files
-
212fb1b6b5a7e2d88adf651e0d84c77e5cb8b8303ac8e4ef006dd8d41656a189.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gtcl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kxvu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.psfx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oncez Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bsp Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ