Behavioral task
behavioral1
Sample
d620ab96b0c67551a9fec7ec50f9fecac99a6001011aa5d22ad3dde4651717b8.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d620ab96b0c67551a9fec7ec50f9fecac99a6001011aa5d22ad3dde4651717b8.exe
Resource
win10v2004-20240426-en
General
-
Target
d620ab96b0c67551a9fec7ec50f9fecac99a6001011aa5d22ad3dde4651717b8
-
Size
42KB
-
MD5
211bf3837aef325d5626e1539ab469fc
-
SHA1
c22ab0f09f0e5d151c447bd9864e18106cceb350
-
SHA256
d620ab96b0c67551a9fec7ec50f9fecac99a6001011aa5d22ad3dde4651717b8
-
SHA512
0e3f8cf8970cc4ecc90033a52384627b4ed209deeef14ec1e5b1d6dbeeebd82694c80f2a18aa6adafb248d85928df218bebbe1f152a522ef890b0bf475c19c6d
-
SSDEEP
768:L62h5nWLQF/NwwCES50BQifgvYnbcuyD7U:L6O5WLiVwtcpfgvYnouy8
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d620ab96b0c67551a9fec7ec50f9fecac99a6001011aa5d22ad3dde4651717b8
Files
-
d620ab96b0c67551a9fec7ec50f9fecac99a6001011aa5d22ad3dde4651717b8.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ktlju Size: 4KB - Virtual size: 4KB
.wu Size: 512B - Virtual size: 4KB