Behavioral task
behavioral1
Sample
265227441c6df93e362ad4976745cf19.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
265227441c6df93e362ad4976745cf19.exe
Resource
win10v2004-20240704-en
General
-
Target
265227441c6df93e362ad4976745cf19.bin
-
Size
100KB
-
MD5
265227441c6df93e362ad4976745cf19
-
SHA1
70757c6d284722a45c42671d0b2b3d02ffd680d0
-
SHA256
02901ca6ed329dfdfbc75f4194662065765761f3aec4958f7f560063e5bb17d0
-
SHA512
5fc46b52a1c5b3888e617ca88f801d67fdc4b4f35515be42b318527bdf88aa55f39bbf0ba2b0a9281cf7cfea69fd453714cc0120f5da63466f09977c7063b85f
-
SSDEEP
768:OmiYdP7os414AqveKZJhrvAsZVB8DfO46x:OlYdUs41hqv3Jm8Ksx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 265227441c6df93e362ad4976745cf19.bin
Files
-
265227441c6df93e362ad4976745cf19.bin.exe windows:4 windows x86 arch:x86
e305fb686a20d7404afbd55bc5b40b00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetProcAddress
LoadLibraryA
lstrcatA
lstrcpyA
GetFileAttributesA
SetFileTime
CloseHandle
GetFileTime
CreateFileA
Sleep
LocalFree
WideCharToMultiByte
lstrlenW
GetCommandLineW
ExitProcess
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetUserDefaultLangID
FindNextFileA
FindFirstFileA
GetEnvironmentVariableA
TerminateProcess
OpenProcess
Process32Next
DeleteFileA
MoveFileExA
Process32First
CreateToolhelp32Snapshot
SetErrorMode
GetStartupInfoA
GetTempPathA
advapi32
RegEnumKeyExA
RegOpenKeyExA
msvcrt
_strcmpi
__setusermatherr
_initterm
_strdup
_controlfp
__getmainargs
__set_app_type
__p__fmode
__p__commode
_except_handler3
toupper
strstr
strlen
malloc
fclose
ftell
fseek
fopen
fwrite
fputs
fread
memset
sscanf
strcpy
free
strcat
abs
strrchr
strcmp
printf
time
_exit
_XcptFilter
exit
_acmdln
_adjust_fdiv
psapi
EnumProcessModules
GetModuleFileNameExA
shell32
CommandLineToArgvW
SHGetFolderPathA
user32
CreateWindowExA
DispatchMessageA
wsprintfA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
UPX0 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE