Behavioral task
behavioral1
Sample
e0d1aed4aa7ced6ad76a159fe5fdf3620f8bf1b3f90c696d66993cdd3dae7b01.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e0d1aed4aa7ced6ad76a159fe5fdf3620f8bf1b3f90c696d66993cdd3dae7b01.exe
Resource
win10v2004-20240709-en
General
-
Target
e0d1aed4aa7ced6ad76a159fe5fdf3620f8bf1b3f90c696d66993cdd3dae7b01
-
Size
47KB
-
MD5
2f810e1254b6200dcf093b3912335a0e
-
SHA1
54b6539a5e921c51dc9d2f46ab5b3a0b09340c61
-
SHA256
e0d1aed4aa7ced6ad76a159fe5fdf3620f8bf1b3f90c696d66993cdd3dae7b01
-
SHA512
b81abedfa1a49125547324de09c7b9b000793050ebc9f1653de689c0b04d76448119150dba6378469718a349262de21e10c168ed1dea12b353bd9d5b241e2b2f
-
SSDEEP
768:i607c92/EyTAYtxqfGNC0klI7C8ycYlI5o194jpCekdX:w7wc1aGNC0klI7CPpIQa4ek
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0d1aed4aa7ced6ad76a159fe5fdf3620f8bf1b3f90c696d66993cdd3dae7b01
Files
-
e0d1aed4aa7ced6ad76a159fe5fdf3620f8bf1b3f90c696d66993cdd3dae7b01.exe windows:4 windows x86 arch:x86
eda5eba597fe391967d136bc44cb5987
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegEnumKeyA
RegQueryValueExA
kernel32
GetTempFileNameA
WriteFile
GetSystemTime
GetCurrentThread
SetThreadPriority
GetDriveTypeA
GlobalAlloc
FindFirstFileA
FindNextFileA
FindClose
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
InterlockedIncrement
InterlockedDecrement
GlobalFree
SetEndOfFile
GetEnvironmentVariableA
GetLastError
CreateMutexA
GetFileAttributesA
CopyFileA
DeleteFileA
CloseHandle
CreateFileA
SetFileAttributesA
lstrlenA
GetTempPathA
GetWindowsDirectoryA
lstrcatA
lstrcpyA
GetModuleFileNameA
ExitThread
Sleep
CreateThread
ExitProcess
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetTickCount
WideCharToMultiByte
GetProcAddress
LoadLibraryA
GetModuleHandleA
ReadFile
SetFilePointer
lstrcmpiA
GetProcessHeap
HeapAlloc
lstrcpynA
lstrcmpA
HeapFree
msvcrt
memset
tolower
memcpy
isdigit
strchr
isalnum
isspace
strlen
_mbscpy
strstr
malloc
_mbscat
realloc
fclose
fread
fopen
time
fwrite
system
memcmp
free
user32
CharUpperBuffA
CharUpperA
CharLowerA
wvsprintfA
wsprintfA
FindWindowA
PostMessageA
ws2_32
bind
listen
accept
htonl
htonl
connect
send
inet_addr
gethostbyname
socket
select
recv
closesocket
htons
htons
sendto
WSAStartup
gethostname
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SCY Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE