Behavioral task
behavioral1
Sample
d410edc3f58ae5fc315e6a991ec7f695ecec65695234fca528be1c7d87c8323b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d410edc3f58ae5fc315e6a991ec7f695ecec65695234fca528be1c7d87c8323b.exe
Resource
win10v2004-20240704-en
General
-
Target
4af91af5e4cdc7c3ffcb265d1d4ba84e.bin
-
Size
5.5MB
-
MD5
7c31740a5bd9689c31a2308e80677e8a
-
SHA1
aac7656088ff9785b53677b9b02d8266e9772bcb
-
SHA256
7ce52d523a7ae09dc92a5602fd3d54eb470d98f2835c02eb4591a55b6e01c654
-
SHA512
beba0a5c7df67f1a96146d1e58a30e5c624fff4f6f7f64a926eaf862893c9c43b63a077436b1a011120b397e4696c550ac996f889d2990bbd7edb843ccbffe2e
-
SSDEEP
98304:ty7DkP0X+8xCw4u26I6j6m+E3jLxWx/+pJgK/UXdYDNjMRh3KdCVF9:tRk1NBLxWBcoXdwiRhR79
Malware Config
Signatures
-
resource yara_rule static1/unpack001/d410edc3f58ae5fc315e6a991ec7f695ecec65695234fca528be1c7d87c8323b.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/d410edc3f58ae5fc315e6a991ec7f695ecec65695234fca528be1c7d87c8323b.exe unpack002/out.upx
Files
-
4af91af5e4cdc7c3ffcb265d1d4ba84e.bin.zip
Password: infected
-
d410edc3f58ae5fc315e6a991ec7f695ecec65695234fca528be1c7d87c8323b.exe.exe windows:6 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 232KB - Virtual size: 668KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ