Behavioral task
behavioral1
Sample
FotoSketcher_3.95_portable_64bit.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
FotoSketcher_3.95_portable_64bit.exe
Resource
win10v2004-20240611-en
General
-
Target
FotoSketcher_3.95_portable_64bit.exe
-
Size
16.4MB
-
MD5
73122d73cac5636f7f0e8eb38545eb66
-
SHA1
cbb098a36350feb62c618bf67ba6bd2cc109b3d5
-
SHA256
68d1990cc7e9652bfa5ce9da70c57ff9e512c478e6351180c57fb77ad47cc03f
-
SHA512
f5af8577ebdfec44c00561358cefeca3b0ae44d2fc75c928ef3107af6406e76e247fb1b1962c98c9e5b9ee74fedd411310d34c365db877b9a0f73f2f940fa134
-
SSDEEP
196608:mEw1d5utp9YDcWhGJiPenYzIA9YSxnghcNtDdHBPx/ZouB0Ct4AtIK/+BMFFCsf1:mZotXlWaiPLJqCnn9xxou37dFJfaj
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FotoSketcher_3.95_portable_64bit.exe
Files
-
FotoSketcher_3.95_portable_64bit.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 22.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12.2MB - Virtual size: 12.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE