Behavioral task
behavioral1
Sample
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
Resource
win10v2004-20240419-en
General
-
Target
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e
-
Size
145KB
-
MD5
5647d4670bf453ea46b04b70cee2eb41
-
SHA1
9cff36e41153665ca479950133b9521a850ceee5
-
SHA256
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e
-
SHA512
d27f7d110ffd521c9a144c99c62a5fce6b1c3956a11edf2e3160f28dc4ac40c3a32953d2d2f66f6b855195426ea35282d94cd20ce0cf8c947e39119bf3ada26a
-
SSDEEP
1536:0MvKGF80crNopDaPsDHtcGquYVnPKp4ZAk3rf:tvvj00DaEDAuYFPJZAG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e
Files
-
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe windows:4 windows x86 arch:x86
9eb57ac2d22f33920e859955b8385196
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetStartupInfoA
SetLastError
LoadLibraryA
LoadResource
LockResource
FindResourceA
GetTimeFormatA
GetDateFormatA
SizeofResource
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
comctl32
InitCommonControlsEx
msvcrt
_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
??3@YAXPAX@Z
??2@YAPAXI@Z
_exit
user32
CreateWindowExA
PostMessageA
DefWindowProcA
SendMessageA
SetWindowTextA
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
LoadIconA
LoadStringA
ShowWindow
UpdateWindow
Sections
UPX0 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE