Behavioral task
behavioral1
Sample
ff6abf8580e769c1f70bd5fe4341fc47d077a343a006ba62c4e240fc02688290.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ff6abf8580e769c1f70bd5fe4341fc47d077a343a006ba62c4e240fc02688290.exe
Resource
win10v2004-20240508-en
General
-
Target
ff6abf8580e769c1f70bd5fe4341fc47d077a343a006ba62c4e240fc02688290
-
Size
2.0MB
-
MD5
7ed6622e146587e326b26f76a89b1dd2
-
SHA1
255aa63e462b1d875e2053218c4a2e8da49b50cd
-
SHA256
ff6abf8580e769c1f70bd5fe4341fc47d077a343a006ba62c4e240fc02688290
-
SHA512
f63693830c36c7eac1ccabefb515558ce9b03fb65ef6f2991985ed97f5ed496d1486e2a895b4232031cad1d3fd43f4d71b49cac9f69737bb84bdf413b9ef1ee7
-
SSDEEP
49152:F2KVwm9iE4MK+2XanI7ye4iqHK9Dx++lNPjEbsPzn9vM77m:Fsm9hKzzyCoKBE+0Qpl
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff6abf8580e769c1f70bd5fe4341fc47d077a343a006ba62c4e240fc02688290
Files
-
ff6abf8580e769c1f70bd5fe4341fc47d077a343a006ba62c4e240fc02688290.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 34KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qhx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sy Size: 512B - Virtual size: 4KB