Behavioral task
behavioral1
Sample
曼陀罗_A.exe
Resource
win7-20240704-en
General
-
Target
曼陀罗_A.exe
-
Size
1.1MB
-
MD5
15a04041e12503a23b5a9983e308c9aa
-
SHA1
a35956b0873c27cf83242738758dbcc467b0dcea
-
SHA256
372bffd992ab7aa62f1b427b2edb73029ad876a47feda01edce9aeb9497dd674
-
SHA512
fd52d318bab293577c572c0d59e340fbdfedaaf869631be509badb3909dddf94f9653f2107ab4e0faf6350b92d2c047e0595af6ec928bd2573f8950a7849be8d
-
SSDEEP
24576:R82EtZLGddLvmQ0TIf5G4Z8FeKovHCZi+qSNSM0s07P4VKONBwk:GBLGLLvITIf5G8ce3v4t0f4VKO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 曼陀罗_A.exe unpack001/out.upx
Files
-
曼陀罗_A.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 952KB - Virtual size: 948KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 972KB - Virtual size: 968KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 385KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ