Behavioral task
behavioral1
Sample
7888b3ebe8332e9ada641695781622a30f67c68c74cba721a0db2b0517f40a56.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7888b3ebe8332e9ada641695781622a30f67c68c74cba721a0db2b0517f40a56.exe
Resource
win10v2004-20240419-en
General
-
Target
7888b3ebe8332e9ada641695781622a30f67c68c74cba721a0db2b0517f40a56
-
Size
114KB
-
MD5
4af7ac1ca7a3a913427d6e85046bc231
-
SHA1
96d78129194699d3492017e8da76a85744c58cb6
-
SHA256
7888b3ebe8332e9ada641695781622a30f67c68c74cba721a0db2b0517f40a56
-
SHA512
9e1b968ffd0121e4ee2e51973e3fb6eaec0a4f2adfb0c0877e537a9a212040d3ada6fd3bd31bb7890584aabdf8c497c47baad9249dbd0020681afaa111f15bf5
-
SSDEEP
1536:W8NaJjXzjCSACsBnoxK8E5SgH5NZk5XEvDBj+:5NmjXzjC6qoxDE1nkSj+
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
7888b3ebe8332e9ada641695781622a30f67c68c74cba721a0db2b0517f40a56.exe windows:6 windows x64 arch:x64
Code Sign
70:53:9b:fc:cb:c3:40:bd:42:fe:2a:a1:70:2e:a1:faCertificate
IssuerCN=64Signer.4Not Before15/09/2023, 14:17Not After15/09/2058, 14:17SubjectCN=64Signer.4ec:5d:0a:6e:60:11:c3:0a:c6:54:6b:44:3a:df:7d:e9:6d:a0:2d:39Signer
Actual PE Digestec:5d:0a:6e:60:11:c3:0a:c6:54:6b:44:3a:df:7d:e9:6d:a0:2d:39Digest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ