Behavioral task
behavioral1
Sample
8613b8a6582631fd03eba0fb80c49c838f978bb7037a8f56c0286e9587bc5b9d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8613b8a6582631fd03eba0fb80c49c838f978bb7037a8f56c0286e9587bc5b9d.exe
Resource
win10v2004-20240508-en
General
-
Target
8613b8a6582631fd03eba0fb80c49c838f978bb7037a8f56c0286e9587bc5b9d
-
Size
1.7MB
-
MD5
355a70718c1642c44fc01cda6a35cda3
-
SHA1
0c87d5fe0906b269385475a26e49c3d05b231296
-
SHA256
8613b8a6582631fd03eba0fb80c49c838f978bb7037a8f56c0286e9587bc5b9d
-
SHA512
c88685b6b3f33be292808606e6d808f0d34ca0275d484e354e913467f6859c0d6075b2153dbebeaabc177184713cffce97d52b15451f860f6dd8c0b7764a1bd7
-
SSDEEP
49152:DB00Ek4SZzZVYsX2qNgGC/UQmeIFsoKNOx6BaY:V02NVYE2ugGCsjFKUxdY
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8613b8a6582631fd03eba0fb80c49c838f978bb7037a8f56c0286e9587bc5b9d
Files
-
8613b8a6582631fd03eba0fb80c49c838f978bb7037a8f56c0286e9587bc5b9d.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gtcl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kxvu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.psfx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oncez Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bsp Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ