Behavioral task
behavioral1
Sample
cd907b54656866318e61efc65dced2e69d501de4dfcb4bb35a2c0603ef8b05b6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cd907b54656866318e61efc65dced2e69d501de4dfcb4bb35a2c0603ef8b05b6.exe
Resource
win10v2004-20240426-en
General
-
Target
cd907b54656866318e61efc65dced2e69d501de4dfcb4bb35a2c0603ef8b05b6
-
Size
495KB
-
MD5
f4d8ad9f25b9243f87adb60095fb6f73
-
SHA1
20e5b2b3580dae5f7741e63014a6f9a47454c82d
-
SHA256
cd907b54656866318e61efc65dced2e69d501de4dfcb4bb35a2c0603ef8b05b6
-
SHA512
79256fa0cea05f5d8dccfcce731d3ead44a9bdefe252d044bdc76c4e76e98fcb0b1545b0ccf2efc77333742ed8652017e16141b275d5b97162d10d4c3e502c12
-
SSDEEP
12288:gEQoShs9VnuO1ndLeJfJLvb70QbTmuXeywMa2XOYWQz:gw9BuasJ54ywMaWOYL
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd907b54656866318e61efc65dced2e69d501de4dfcb4bb35a2c0603ef8b05b6
Files
-
cd907b54656866318e61efc65dced2e69d501de4dfcb4bb35a2c0603ef8b05b6.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gtcl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kxvu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.psfx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oncez Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bsp Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ