Behavioral task
behavioral1
Sample
52c64c941df219883eb008034f794fad4570ca2b712e83f87b86d792e0cced97.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
52c64c941df219883eb008034f794fad4570ca2b712e83f87b86d792e0cced97.exe
Resource
win10v2004-20240508-en
General
-
Target
52c64c941df219883eb008034f794fad4570ca2b712e83f87b86d792e0cced97
-
Size
269KB
-
MD5
8c94d1e308ffc155492b2d3494e79407
-
SHA1
381dfe74d972775a21d436dc1d396f938398bba1
-
SHA256
52c64c941df219883eb008034f794fad4570ca2b712e83f87b86d792e0cced97
-
SHA512
2f7c7588f7d96e0e36b6849ebcdb98ac043d8dc47ae2c1e2b688e9ddadc492eb1d301f4a59929d015e190829362036f8f1da561c29cb5970f9a1c8e6037bfdf7
-
SSDEEP
6144:2/w8abEfC7QCAUtrj89/BskQkWTfZQ0/0cdmiRwxArDUn:24K6LzHKcvTZQ0/0zJxQDU
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52c64c941df219883eb008034f794fad4570ca2b712e83f87b86d792e0cced97
Files
-
52c64c941df219883eb008034f794fad4570ca2b712e83f87b86d792e0cced97.exe windows:4 windows x86 arch:x86
f4452cf9d9e8e1d223a3daf8c60d11ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DuplicateHandle
InitializeCriticalSection
CreateMutexW
OpenMutexW
LocalFree
LocalAlloc
GetModuleHandleA
lstrcmpA
GetVersion
GetTickCount
GetModuleFileNameA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
WaitForMultipleObjects
WaitForSingleObject
GetCurrentProcessId
SetEvent
GetCurrentThreadId
CreateEventW
GetCurrentProcess
GetVersionExW
lstrcpynA
lstrlenA
GetLastError
MultiByteToWideChar
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
FreeLibrary
GetFileAttributesW
LoadLibraryW
GetCurrentThread
GetProcAddress
user32
PeekMessageW
advapi32
RegQueryValueExA
RegOpenKeyA
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyA
EqualSid
shell32
ord680
ShellExecuteExW
SHGetDesktopFolder
msasn1
ASN1BEREncCheck
ASN1_GetDecoderOption
ASN1_CloseDecoder
ASN1BERDecSXVal
ASN1BERDecOpenType
ASN1BERDecZeroCharString
ASN1BEREncCharString
ASN1BERDecEndOfContents
ASN1BEREncS32
ASN1DecAlloc
ASN1_CloseEncoder
ASN1_Decode
ASN1objectidentifier2_cmp
ASN1_CloseModule
ASN1BERDecBool
ASN1BEREncRemoveZeroBits
fmifs
Extend
Sections
UPX1 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.utL Size: 3KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.x Size: 2KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.REHKgI Size: 512B - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 105KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 350KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.R Size: 1024B - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 117KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.OoYrd Size: 3KB - Virtual size: 485KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ