Behavioral task
behavioral1
Sample
6e363bbd46222f36e74a102911e10f9e5955be3cef18ba1b3058a17e87b60c3d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6e363bbd46222f36e74a102911e10f9e5955be3cef18ba1b3058a17e87b60c3d.exe
Resource
win10v2004-20240508-en
General
-
Target
6e363bbd46222f36e74a102911e10f9e5955be3cef18ba1b3058a17e87b60c3d
-
Size
7.1MB
-
MD5
2e4b4071edea28e19adb71e5303cf379
-
SHA1
7c2ca14220ddb9b5885e5db87c5ba5736044f09c
-
SHA256
6e363bbd46222f36e74a102911e10f9e5955be3cef18ba1b3058a17e87b60c3d
-
SHA512
11d01280553bd9beddbba90757233671d1ad68762e85d2b38031d75b9c4f06ea34a98eba16d052d1c11cc250a3bb67ca32e9649510e18e26b25e019d668b1181
-
SSDEEP
196608:zeIKNCzNA7rlvRz1rrFBV6tpjuj6gYPKHCKsc:zsjUtYj6gYPYN
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e363bbd46222f36e74a102911e10f9e5955be3cef18ba1b3058a17e87b60c3d
Files
-
6e363bbd46222f36e74a102911e10f9e5955be3cef18ba1b3058a17e87b60c3d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE