Behavioral task
behavioral1
Sample
69ebd2b9ba089c54564bb5f7b3ac6f8d2a335af0a244d8196a1b605e3fae9778.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
69ebd2b9ba089c54564bb5f7b3ac6f8d2a335af0a244d8196a1b605e3fae9778.exe
Resource
win10v2004-20240426-en
General
-
Target
69ebd2b9ba089c54564bb5f7b3ac6f8d2a335af0a244d8196a1b605e3fae9778
-
Size
356KB
-
MD5
6086b1f6341a8263261bc6ff183d400b
-
SHA1
304f7c7ac0b48a18c773368740d83fe1376d468e
-
SHA256
69ebd2b9ba089c54564bb5f7b3ac6f8d2a335af0a244d8196a1b605e3fae9778
-
SHA512
6dae1591545416aa85ab72b0a388c8d3f9e5615e43aa688820375f644464608d209a71a92114cecbf15c5ac10c6a89d9e3183f9c482b04341841cf0fb9c21c0f
-
SSDEEP
6144:bjluQoSsqaxIo5R4nM/IQ37NNGxzHw5fV/ztiRs2nXWAE7nXsh5Klr/P4Hc1JmDX:bEQoSx0q07NAxsftsa2GAQnXsh5UrHBa
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 69ebd2b9ba089c54564bb5f7b3ac6f8d2a335af0a244d8196a1b605e3fae9778
Files
-
69ebd2b9ba089c54564bb5f7b3ac6f8d2a335af0a244d8196a1b605e3fae9778.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ktlju Size: 512B - Virtual size: 4KB
.wu Size: 512B - Virtual size: 4KB
.data Size: 512B - Virtual size: 4KB
.nbd Size: 512B - Virtual size: 4KB
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ