Behavioral task
behavioral1
Sample
191c840a62ceecabe42eafcc77dcaee02bab828fd555dbdd765f0f0395dce063.exe
Resource
win7-20240215-en
General
-
Target
191c840a62ceecabe42eafcc77dcaee02bab828fd555dbdd765f0f0395dce063
-
Size
120KB
-
MD5
b20ae7ce30f01d9192a62692bc2764f9
-
SHA1
91ee959d596e4a2702783b2041d7f470559d356c
-
SHA256
191c840a62ceecabe42eafcc77dcaee02bab828fd555dbdd765f0f0395dce063
-
SHA512
5447baa04fd61d35cad0e90c48b79fb7179e2b6a69020e76bd46cb413579fb666f14615ab258aa60846cee03b70e99bc05d7fa5d2e0a5fd038b2ef1618605860
-
SSDEEP
3072:/hOmTsF93UYfwC6GIoutKzdbr9XcMRwk6mNb5TcPeJipUe:/cm4FmowdHoSKZf5cX5m7TNe
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
Processes:
resource yara_rule sample UPX -
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 191c840a62ceecabe42eafcc77dcaee02bab828fd555dbdd765f0f0395dce063
Files
-
191c840a62ceecabe42eafcc77dcaee02bab828fd555dbdd765f0f0395dce063.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
vryeypb Size: - Virtual size: 104KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE