Behavioral task
behavioral1
Sample
windows defender.exe
Resource
win11-20240508-en
General
-
Target
windows defender.exe
-
Size
593KB
-
MD5
0888788f77f9292ae567d967d6fec089
-
SHA1
854599eac2c211dc92b83ef22830d773e5d14067
-
SHA256
13257f2173f55702469eb70b7b1328b788ba8d75ce1da5ce34d83ad3e1699e38
-
SHA512
c1835093e717724371e2bd9b0d2180e74ee54bd5710611b7420b2244b9f784038915ed9140739cc2e1632ec6f13b6c448a99804625c48d5bee83a6e7db367486
-
SSDEEP
12288:jLtttR8mrdE6FrsPguPtgS4Ye1R4h2xw5SSHtA2c1ied534KEtIQNNbX5OFSZKAG:ftttR8mTythOR801SHt9c7dNQH5Okw
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource windows defender.exe
Files
-
windows defender.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 590KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE