Behavioral task
behavioral1
Sample
5167fbc8339d967c3f24f9cba5527470N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5167fbc8339d967c3f24f9cba5527470N.exe
Resource
win10v2004-20240709-en
General
-
Target
5167fbc8339d967c3f24f9cba5527470N.exe
-
Size
232KB
-
MD5
5167fbc8339d967c3f24f9cba5527470
-
SHA1
f2dea53a5b6a63d09c7f1511b507c1454f5672fe
-
SHA256
89b07e49d6f581172bcddc6527772d1a0e2b65f267992b8d49743685cd3db3e5
-
SHA512
cac51e3e7e54643459c5dba1a56caa89074169e76fc7ba97760c6dfc059e6482c6d871981d3771c891830663f4af3a97ae51e2592aaa88fa2b3b2b4034f13550
-
SSDEEP
3072:9xmwiE/+bocWe3i+EKG6eVpDJ4JtYRDbbNUWpr:ywijzWey+HGljDJ4JtaDbBU0r
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5167fbc8339d967c3f24f9cba5527470N.exe
Files
-
5167fbc8339d967c3f24f9cba5527470N.exe.exe windows:4 windows x86 arch:x86
0bf828322c700cdc483385c4fabdaaff
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
WaitForMultipleObjects
SetEvent
CreateThread
WaitForSingleObject
ResetEvent
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
FreeLibrary
AreFileApisANSI
LoadLibraryW
GetModuleFileNameA
GetModuleFileNameW
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
GetSystemDirectoryW
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
RemoveDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTempPathA
GetTempFileNameA
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
CreateFileA
CreateFileW
GetFileSize
SetFilePointer
ReadFile
SetFileTime
WriteFile
SetEndOfFile
CreateEventA
LeaveCriticalSection
EnterCriticalSection
Sleep
CreateProcessA
GetCommandLineW
GetVersionExA
GetStartupInfoA
comctl32
ord17
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_except_handler3
??1type_info@@UAE@XZ
wcslen
wcsncpy
memcpy
free
malloc
memmove
memcmp
_purecall
_CxxThrowException
__CxxFrameHandler
_controlfp
oleaut32
VariantClear
SysAllocString
shell32
ShellExecuteExA
user32
ShowWindow
DestroyWindow
KillTimer
EndDialog
GetDlgItem
PostMessageA
SendMessageA
SetTimer
MessageBoxW
SetWindowTextW
SetWindowTextA
LoadStringW
LoadStringA
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
GetWindowLongA
CharUpperW
CharUpperA
Sections
UPX0 Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE