Behavioral task
behavioral1
Sample
75fc49ea6af2338580e20b1ac25ebfc26c8a290f8cb29aa80f1a3a6d89d95a5e.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
75fc49ea6af2338580e20b1ac25ebfc26c8a290f8cb29aa80f1a3a6d89d95a5e.exe
Resource
win10v2004-20240508-en
General
-
Target
ebfeb52ca8329ec9700ef33c7b5ff39a.bin
-
Size
4.9MB
-
MD5
4361bf2f1be45380f4adfcedcdc2de21
-
SHA1
94ebf7b4228ed2abe8df6e83e1863aa2654d7eb1
-
SHA256
fc0a2bc8e78467afa75b0382536a1764b1618b1b314317f7370780154dd3564a
-
SHA512
c6cbadba56a8f97400c6dba146be31b12f501625b3e9b893a05bebe279bf3078f9f101b25e0b765b50f6e4ab2b3a73c17dada9d473c6ab122be272c291cfce81
-
SSDEEP
98304:MHItUSjmTiP25H06b6YuClCWRzfpMuGzE5/lm0sHhF7IEt3VH0+:YILh25U6OnCqzAUtcWFHf
Malware Config
Signatures
-
resource yara_rule static1/unpack001/75fc49ea6af2338580e20b1ac25ebfc26c8a290f8cb29aa80f1a3a6d89d95a5e.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/75fc49ea6af2338580e20b1ac25ebfc26c8a290f8cb29aa80f1a3a6d89d95a5e.exe
Files
-
ebfeb52ca8329ec9700ef33c7b5ff39a.bin.zip
Password: infected
-
75fc49ea6af2338580e20b1ac25ebfc26c8a290f8cb29aa80f1a3a6d89d95a5e.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 12.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE