Behavioral task
behavioral1
Sample
efb25e3836ae3a796a937749b2df767da81e6c388b01410ea79c1ce4b5a1117f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
efb25e3836ae3a796a937749b2df767da81e6c388b01410ea79c1ce4b5a1117f.exe
Resource
win10v2004-20240412-en
General
-
Target
efb25e3836ae3a796a937749b2df767da81e6c388b01410ea79c1ce4b5a1117f
-
Size
289KB
-
MD5
12775eb78b9d58a5e1a4d4a854bf7401
-
SHA1
79ff041e850b632b09fbc8b7c8a0edd22abb6427
-
SHA256
efb25e3836ae3a796a937749b2df767da81e6c388b01410ea79c1ce4b5a1117f
-
SHA512
fb13586e104194d722c1d054ff7c9d7ff6e2619912797c947dd1977393a2cda4e9fac94007a21f07ff27a89d4317ca45eed105d711c2fd43816dd030d15a5e54
-
SSDEEP
6144:TL+rqBloJ6nkP+6b7SbDkdhYkQ/B+RnkP+6bfbSdbd5kCbS76heDk:TLySlYt+VbDyylZ+A2bLV9v
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource efb25e3836ae3a796a937749b2df767da81e6c388b01410ea79c1ce4b5a1117f unpack001/out.upx
Files
-
efb25e3836ae3a796a937749b2df767da81e6c388b01410ea79c1ce4b5a1117f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 168KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.bss Size: - Virtual size: 145KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE