Behavioral task
behavioral1
Sample
d0a7e7b4f740a9b11fd9eb47b8668c8cd1d3abab102d173d8155a41dc20097a6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d0a7e7b4f740a9b11fd9eb47b8668c8cd1d3abab102d173d8155a41dc20097a6.exe
Resource
win10v2004-20240508-en
General
-
Target
d0a7e7b4f740a9b11fd9eb47b8668c8cd1d3abab102d173d8155a41dc20097a6
-
Size
460KB
-
MD5
c166fdce99722b3e054784c7f156f2e0
-
SHA1
5b1d789994436132061512d3db22436f88b79db8
-
SHA256
d0a7e7b4f740a9b11fd9eb47b8668c8cd1d3abab102d173d8155a41dc20097a6
-
SHA512
222a0704ee01db4b595ad584aeaee94b1b07112e76519e58cd0829847023efbbeadcb21264578cf96a0217574c78e210c53f2191546661dd4267d5c70cd5144a
-
SSDEEP
3072:7T8iRbuVxBGY4J6tFLHPr1fOsY1JWOtENy6cTJ:7XbyvoWFQjJmIl
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0a7e7b4f740a9b11fd9eb47b8668c8cd1d3abab102d173d8155a41dc20097a6
Files
-
d0a7e7b4f740a9b11fd9eb47b8668c8cd1d3abab102d173d8155a41dc20097a6.exe windows:4 windows x86 arch:x86
17629847cf056ca5a2c1fda386c78fc1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalAlloc
ExitProcess
WriteFile
SetFilePointer
GetCurrentProcessId
GetCurrentThreadId
GetCommandLineW
GlobalFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
CloseHandle
GetCommandLineA
GetVersionExA
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetACP
GetOEMCP
VirtualAlloc
InterlockedExchange
VirtualQuery
VirtualProtect
GetSystemInfo
SetStdHandle
GetLocaleInfoW
FlushFileBuffers
Sleep
LocalFree
lstrcmpW
lstrlenW
GetStartupInfoA
GetCurrentThread
GetStartupInfoW
CreateFileW
advapi32
RegQueryValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegOpenKeyA
user32
LoadIconA
GetSystemMetrics
Sections
UPX0 Size: 276KB - Virtual size: 276KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE