Behavioral task
behavioral1
Sample
c6dbfbdd5108be258ad34d77d4e5972338d1d6b94ebf13d4a5e6ffd7a2fa7aa1.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c6dbfbdd5108be258ad34d77d4e5972338d1d6b94ebf13d4a5e6ffd7a2fa7aa1.exe
Resource
win10v2004-20240508-en
General
-
Target
c6dbfbdd5108be258ad34d77d4e5972338d1d6b94ebf13d4a5e6ffd7a2fa7aa1
-
Size
351KB
-
MD5
c0daa507cc5a2fd02f1ea70d287f8d48
-
SHA1
12b36bc69950e954a073b3644a87cf19ba974a9c
-
SHA256
c6dbfbdd5108be258ad34d77d4e5972338d1d6b94ebf13d4a5e6ffd7a2fa7aa1
-
SHA512
cf7ab081abe358dd2673dc56e2b0f33a87a74c2e2348ca4c3dea412be907d6012af49a0950fa1a35bb8982147010de33d35af2dfc972683d7c6b5e058e6f97d5
-
SSDEEP
6144:/MAoVNwbqfqHYzfmS3Icbq+8Z+8gU/I1GFCywyNXGeBWW+HkiWEk8Jf:0A1N4z71m+MGGUy1NWeBWW+H348l
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource c6dbfbdd5108be258ad34d77d4e5972338d1d6b94ebf13d4a5e6ffd7a2fa7aa1 unpack001/out.upx
Files
-
c6dbfbdd5108be258ad34d77d4e5972338d1d6b94ebf13d4a5e6ffd7a2fa7aa1.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.htext Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE