Behavioral task
behavioral1
Sample
4d8868ff059e6035c8692703a6b88aa0N.exe
Behavioral task
behavioral2
Sample
4d8868ff059e6035c8692703a6b88aa0N.exe
General
-
Target
4d8868ff059e6035c8692703a6b88aa0N.exe
-
Size
84KB
-
MD5
4d8868ff059e6035c8692703a6b88aa0
-
SHA1
7ec0ac0738d4af78206eca4f071d42c3fab6a47d
-
SHA256
8fb66a17c18195769fe7c1d7ba2d850669c1a29e064071e72415d7e929744a85
-
SHA512
2564777eb9c022c0f807e3ed79d1a267a8c55f169a067239eb6c0a8e8513f27fb3a811e3df90c01bf6ec5100cabc3009567ac3cedf0d1239ab3634c8476ebbf7
-
SSDEEP
1536:Vze/CZHwiaw2ZHL0RXM85ZmWncfnjLRynOcvESr5JC137l:UqwpwnfWrlyOcEiMl
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d8868ff059e6035c8692703a6b88aa0N.exe
Files
-
4d8868ff059e6035c8692703a6b88aa0N.exe.exe windows:4 windows x86 arch:x86
5674019df43052483045b6e91330a8a4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
DeviceIoControl
CreateFileA
GetVersion
GetTickCount
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
_getch
sscanf
_c_exit
_exit
_XcptFilter
_cexit
exit
fopen
__getmainargs
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_initterm
fwrite
fclose
printf
__initenv
haspms32
hasp
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE