Behavioral task
behavioral1
Sample
d13d426640a0f2cc07aa6837bc16d786eb17f3e1799e97a1bb18495051cf8947.exe
Resource
win7-20240508-en
General
-
Target
6f5ec28062ca6d4425335da4d654c897.bin
-
Size
557KB
-
MD5
cf1ba4d69ba775b04b8905781d037c92
-
SHA1
81f370fd08eeecb2d302f5dbf82125db11643276
-
SHA256
c8b739721eb7368c14bc64848ef7331ad186a57428ff72d9c004966925672c91
-
SHA512
fc50185fbe86a74d54f837767ca66729444bdae0f2077c3242c1c3ee02e9a51692b029786d2bef56fffff16386fcdce5a8233844b8b33a2a50125f5cadb2d386
-
SSDEEP
12288:R/cLZ2iE9wCA196TDgwIPuMinKNQNuEKKPCaDk2UxVUUwOjr:R/cLZ2iE9F4UgaM2MEKmy2UxVU4jr
Malware Config
Signatures
-
resource yara_rule static1/unpack001/d13d426640a0f2cc07aa6837bc16d786eb17f3e1799e97a1bb18495051cf8947.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d13d426640a0f2cc07aa6837bc16d786eb17f3e1799e97a1bb18495051cf8947.exe
Files
-
6f5ec28062ca6d4425335da4d654c897.bin.zip
Password: infected
-
d13d426640a0f2cc07aa6837bc16d786eb17f3e1799e97a1bb18495051cf8947.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 557KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ