Behavioral task
behavioral1
Sample
15733e258ed7ca17ab61aa92027c7693640c489675bf9c0cdae382fccf750232.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
15733e258ed7ca17ab61aa92027c7693640c489675bf9c0cdae382fccf750232.exe
Resource
win10v2004-20240419-en
General
-
Target
15733e258ed7ca17ab61aa92027c7693640c489675bf9c0cdae382fccf750232
-
Size
23KB
-
MD5
9c1b22af4847e58122039459117b5650
-
SHA1
e1b2c918a047353d420ea1c1e239d5a8614de7ca
-
SHA256
15733e258ed7ca17ab61aa92027c7693640c489675bf9c0cdae382fccf750232
-
SHA512
5499080b743666256199a12fb5d7b3b5ece6c00eb0cc0c2fc5c432c0fdb81673b9594e7ac0bb50a6ab7557d95f5e7f6daa92c55bfc228b3d35e7ca3b398d17eb
-
SSDEEP
384:aGpN5/SfmVoonJWpSu+Ip7JLyaBOEj63eVi06MCLGuW6:fhZSoEpnp7JLyWWElhCSur
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 15733e258ed7ca17ab61aa92027c7693640c489675bf9c0cdae382fccf750232 unpack001/out.upx
Files
-
15733e258ed7ca17ab61aa92027c7693640c489675bf9c0cdae382fccf750232.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.htext Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE