Behavioral task
behavioral1
Sample
Snapshot备份还原x86.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Snapshot备份还原x86.exe
Resource
win10v2004-20240426-en
General
-
Target
Snapshot备份还原x86.exe
-
Size
331KB
-
MD5
55c27e0515fc43aaaaae5268ad823a5a
-
SHA1
89afe7de55094fe67a96dad9927beb9313cfc092
-
SHA256
0e25d02f97ca625771c6e928e9424824d2506ab49f6d618cd2664146414cb5f1
-
SHA512
a1e28ff07449f33a2f0743794c58894cdbcf41e3ba6eb0147069d370300aa40e9d2daad3e8c797ed9725745814cdad3c352faf3c205d6c3036a0d2f8a80316f4
-
SSDEEP
6144:yO9gBClXtEkuUv/1oidd0ufc91n6UpB43X1lk28kmbWQTuey4Kt/8foS7:yD+GkuUX1oid309B6UpBqk2/maymGoS7
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Snapshot备份还原x86.exe
Files
-
Snapshot备份还原x86.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 408KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 326KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE