Static task
static1
Behavioral task
behavioral1
Sample
ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe
Resource
win10v2004-20240508-en
General
-
Target
ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe
-
Size
2.2MB
-
MD5
815968c1e37397cea2bdb59e495302e5
-
SHA1
5685534a64708ff79755b6567fb144f97582fbbe
-
SHA256
ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15
-
SHA512
b8ebc84c5165008161aa7aec8671754cac116f8d15e8fda087ed63b67dc75b0b4e40d76b4aba3d53a150f18ed1c3bdd00f7f1bc669533ee25cb9e630a9b37c95
-
SSDEEP
24576:Jkpxqh7TXAQAbg82Xbvue836blvPuA9xG0bTd2jBx024soFgXEqXw04Xw+z9jVQw:y0hXA282XKeCuiJ4soFgXEqXw0GV
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Processes:
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe
Files
-
ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 1020KB - Virtual size: 1020KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE