Behavioral task
behavioral1
Sample
4fc4e3a83b16edfc73771a406fe95aab0d6a42939380d21e6820e695efd1494d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4fc4e3a83b16edfc73771a406fe95aab0d6a42939380d21e6820e695efd1494d.exe
Resource
win10v2004-20240226-en
General
-
Target
4fc4e3a83b16edfc73771a406fe95aab0d6a42939380d21e6820e695efd1494d
-
Size
1.8MB
-
MD5
35bd6091ce6194d73a3ab3ff7d2cd0ab
-
SHA1
f835e0c63b8344b14815e128e8a491f7e21213cc
-
SHA256
4fc4e3a83b16edfc73771a406fe95aab0d6a42939380d21e6820e695efd1494d
-
SHA512
70769998b4f950a94b65cf11f02f925f2ba18b53b2b8010450c0f88ea86b7b3acc8b3f90ebbbaca24b31c03c67dc00925d3e73945ee994c05c4dc0697de9be13
-
SSDEEP
49152:FlMjn/rOrnqNuaY++G11gC3IdpTO6EtrksbG:FlMDjOrnqNuPfMg9dBO/YKG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4fc4e3a83b16edfc73771a406fe95aab0d6a42939380d21e6820e695efd1494d
Files
-
4fc4e3a83b16edfc73771a406fe95aab0d6a42939380d21e6820e695efd1494d.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 34KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qhx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sy Size: 512B - Virtual size: 4KB