Behavioral task
behavioral1
Sample
ffbde6866ce1c4966c7a4e06550217d8e5ec04983e00f55997dbc5381800526e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ffbde6866ce1c4966c7a4e06550217d8e5ec04983e00f55997dbc5381800526e.exe
Resource
win10v2004-20240419-en
General
-
Target
ffbde6866ce1c4966c7a4e06550217d8e5ec04983e00f55997dbc5381800526e
-
Size
128KB
-
MD5
41349c05c838426c6787f2c8d3782bb1
-
SHA1
21751d0247b7e21e4bbd940be07dc6bd99d6a602
-
SHA256
ffbde6866ce1c4966c7a4e06550217d8e5ec04983e00f55997dbc5381800526e
-
SHA512
6a2215e77c4745db5af8064fc8e3f286e66098ac582cf707c4c11dfd9b0b2539bd2546a25882dd2954b2e6e8591226b56c9fe2d00820ad178ecc988c24047803
-
SSDEEP
3072:+nymCAIuZAIuYSMjoqtMHfhf5SGfFpsJOfFpsJQ:JmCAIuZAIuDMVtM/XSY
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffbde6866ce1c4966c7a4e06550217d8e5ec04983e00f55997dbc5381800526e
Files
-
ffbde6866ce1c4966c7a4e06550217d8e5ec04983e00f55997dbc5381800526e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE