Behavioral task
behavioral1
Sample
62967cbce2c17c2b9f04329bbbc6cd357993a00ffc23b825f7e199fc74232eb1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
62967cbce2c17c2b9f04329bbbc6cd357993a00ffc23b825f7e199fc74232eb1.exe
Resource
win10v2004-20240412-en
General
-
Target
62967cbce2c17c2b9f04329bbbc6cd357993a00ffc23b825f7e199fc74232eb1
-
Size
116KB
-
MD5
aa0a898688686ba1b324987df69e4cb7
-
SHA1
245b03301c23bb20e35ce91f18e552373af6d031
-
SHA256
62967cbce2c17c2b9f04329bbbc6cd357993a00ffc23b825f7e199fc74232eb1
-
SHA512
1b284344492d3c1e2693901629b7020e2b3dd32bf975d6fe45bd870af55d0a58d7112fc021afc9114dff5d8554c3ad43e5bd1ac9e83bdcc423b2e54c5c9d81aa
-
SSDEEP
1536:qwkaZI1mKRXkEmYnEjE9Y9hNXnlcxdxH032bVSBkqCbmDCLcQ/MKk+A+BOK1l:q3ai1mKD5E99SH0oVSBrD4cEN
Malware Config
Signatures
-
Detects executables packed with aPLib. 1 IoCs
resource yara_rule static1/unpack001/out.upx INDICATOR_EXE_Packed_aPLib -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 62967cbce2c17c2b9f04329bbbc6cd357993a00ffc23b825f7e199fc74232eb1 unpack001/out.upx
Files
-
62967cbce2c17c2b9f04329bbbc6cd357993a00ffc23b825f7e199fc74232eb1.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 113KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 94KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ