Behavioral task
behavioral1
Sample
d6475747117c05a6c7b6095f413cdf188680b62628a931dd937d76352e2cb61b.exe
Resource
win7-20240221-en
General
-
Target
d6475747117c05a6c7b6095f413cdf188680b62628a931dd937d76352e2cb61b
-
Size
2.7MB
-
MD5
26326155f9efa665e0b197d16793acb5
-
SHA1
0f42b51eaff0f1e52f8eb652cc74bf9effc291b4
-
SHA256
d6475747117c05a6c7b6095f413cdf188680b62628a931dd937d76352e2cb61b
-
SHA512
723191b6548f12b519814c5ae5a788d63600a0c18815fa7ed37fbd6979740bc08874a5720d73b59e31164c294c55995d059405438ceff55e13fc1f9120eccb1e
-
SSDEEP
49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8Dze7jcmWH8SKJhSX+:N0GnJMOWPClFdx6e0EALKWVTffZiPAc6
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6475747117c05a6c7b6095f413cdf188680b62628a931dd937d76352e2cb61b
Files
-
d6475747117c05a6c7b6095f413cdf188680b62628a931dd937d76352e2cb61b.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE