Behavioral task
behavioral1
Sample
b727c622233b926929f73e4d91c12a7903b1ca14144f255b0afe9cd1a88b4253.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b727c622233b926929f73e4d91c12a7903b1ca14144f255b0afe9cd1a88b4253.exe
Resource
win10v2004-20240508-en
General
-
Target
b727c622233b926929f73e4d91c12a7903b1ca14144f255b0afe9cd1a88b4253
-
Size
63KB
-
MD5
53b5fea127c2cf6db2df63aac7570bcc
-
SHA1
1db662613685f906a2394775d50261fadad6241a
-
SHA256
b727c622233b926929f73e4d91c12a7903b1ca14144f255b0afe9cd1a88b4253
-
SHA512
2723ec0db2fe1b3b3baccf7d8aeb9314ffc71061f1890d08c9b3a669ba0a59db1aa391414ad9b2bda3830557b765e30cf4ef83225034a1f8ee03e39f18fa8423
-
SSDEEP
96:Mv110GxW2FjJYPmVI+V9IGjSJGs+K1C+Rv2aKb43dkU:Mv110GPdYPmVI+UGj8C+RPj3dkU
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource b727c622233b926929f73e4d91c12a7903b1ca14144f255b0afe9cd1a88b4253 unpack001/out.upx
Files
-
b727c622233b926929f73e4d91c12a7903b1ca14144f255b0afe9cd1a88b4253.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE