Behavioral task
behavioral1
Sample
f8abc8e5be45549037d367e3fa555c5890fd3a2cc578229171b43c6ef7c08357.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8abc8e5be45549037d367e3fa555c5890fd3a2cc578229171b43c6ef7c08357.exe
Resource
win10v2004-20240226-en
General
-
Target
f8abc8e5be45549037d367e3fa555c5890fd3a2cc578229171b43c6ef7c08357
-
Size
208KB
-
MD5
f0fe60f0e21df3ab81f14d929fa8e297
-
SHA1
d6d57e5261d3d53afb6162f66f588f657fbfc23e
-
SHA256
f8abc8e5be45549037d367e3fa555c5890fd3a2cc578229171b43c6ef7c08357
-
SHA512
bee448898c4526c4e2fe578c0440ff9d8d6d7ad8eab3d59ed7298f5e6c97e8217c3ffef0ad7fb6ebff0212db6cf8296cc23a7cf01e2364dc41adcc3e7815eb61
-
SSDEEP
3072:SdEUfKj8BYbDiC1ZTK7sxtLUIG5yyoDU9q3XRrMBEGltj95y6hsYDRdfb:SUSiZTK40syv
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8abc8e5be45549037d367e3fa555c5890fd3a2cc578229171b43c6ef7c08357
Files
-
f8abc8e5be45549037d367e3fa555c5890fd3a2cc578229171b43c6ef7c08357.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ