Behavioral task
behavioral1
Sample
a6f4bd6b949467e9fad22c792c5e751167d9cbc241bac66d7137d48270e06dae.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a6f4bd6b949467e9fad22c792c5e751167d9cbc241bac66d7137d48270e06dae.exe
Resource
win10v2004-20240709-en
General
-
Target
a6f4bd6b949467e9fad22c792c5e751167d9cbc241bac66d7137d48270e06dae
-
Size
47KB
-
MD5
157750abbfc3062eb9f314e9dcf200bd
-
SHA1
a3f5da7e9ee334c7991e7b3515ce49b9045a64b7
-
SHA256
a6f4bd6b949467e9fad22c792c5e751167d9cbc241bac66d7137d48270e06dae
-
SHA512
5343992d8ddd9643f3ad9d8083a7c507e976c5d5416ff3b596a7cbe0dda1a79e124b1414384929b8bc77ce575f6593929f9fd6b053fe2338031790eba9095925
-
SSDEEP
768:i607c92/EyTAYtxqfGNC0klI7C8ycYlI5o194jpCekdXA:w7wc1aGNC0klI7CPpIQa4ekA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6f4bd6b949467e9fad22c792c5e751167d9cbc241bac66d7137d48270e06dae
Files
-
a6f4bd6b949467e9fad22c792c5e751167d9cbc241bac66d7137d48270e06dae.exe windows:4 windows x86 arch:x86
eda5eba597fe391967d136bc44cb5987
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegEnumKeyA
RegQueryValueExA
kernel32
GetTempFileNameA
WriteFile
GetSystemTime
GetCurrentThread
SetThreadPriority
GetDriveTypeA
GlobalAlloc
FindFirstFileA
FindNextFileA
FindClose
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
InterlockedIncrement
InterlockedDecrement
GlobalFree
SetEndOfFile
GetEnvironmentVariableA
GetLastError
CreateMutexA
GetFileAttributesA
CopyFileA
DeleteFileA
CloseHandle
CreateFileA
SetFileAttributesA
lstrlenA
GetTempPathA
GetWindowsDirectoryA
lstrcatA
lstrcpyA
GetModuleFileNameA
ExitThread
Sleep
CreateThread
ExitProcess
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetTickCount
WideCharToMultiByte
GetProcAddress
LoadLibraryA
GetModuleHandleA
ReadFile
SetFilePointer
lstrcmpiA
GetProcessHeap
HeapAlloc
lstrcpynA
lstrcmpA
HeapFree
msvcrt
memset
tolower
memcpy
isdigit
strchr
isalnum
isspace
strlen
_mbscpy
strstr
malloc
_mbscat
realloc
fclose
fread
fopen
time
fwrite
system
memcmp
free
user32
CharUpperBuffA
CharUpperA
CharLowerA
wvsprintfA
wsprintfA
FindWindowA
PostMessageA
ws2_32
bind
listen
accept
htonl
htonl
connect
send
inet_addr
gethostbyname
socket
select
recv
closesocket
htons
htons
sendto
WSAStartup
gethostname
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SCY Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE