Shellex
Behavioral task
behavioral1
Sample
087fb1a45e4bcafde3276474e3006690N.exe
Resource
win7-20240708-en
General
-
Target
087fb1a45e4bcafde3276474e3006690N.exe
-
Size
136KB
-
MD5
087fb1a45e4bcafde3276474e3006690
-
SHA1
e821e36507450e85876ecaaa4103a1e4ffe1175c
-
SHA256
579535a1bbfaad326bae01bc3e7e6abf5f87a5adeb93757af95cc52b8d53e84f
-
SHA512
8d20faa2c3a1b8bf84e82165380266adad2fb0f8b2af0a45f3b47b7079c14c312b0d9b6c04fbf8da753fc192a60cee0a46a58d59ebc8bf5aabae635828d59ff8
-
SSDEEP
768:QoTJwnrgeWGJaj2b2/K6/1CSGIKPlavRzY0nEs3UgLM6hPuXFopMBzW9FDkBSQya:Q+bs4K6dyNPIvRMEEghmXip4iFAJ6
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 087fb1a45e4bcafde3276474e3006690N.exe
Files
-
087fb1a45e4bcafde3276474e3006690N.exe.exe windows:4 windows x86 arch:x86
f8a1626505bd9e669518aa8e85a146d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDiskFreeSpaceExA
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
HeapFree
VirtualProtect
GetProcessHeap
HeapAlloc
lstrcmpiA
GetCurrentThreadId
GetFileAttributesA
DefineDosDeviceA
MoveFileExA
ExpandEnvironmentStringsA
CopyFileA
SetFileAttributesA
CreateDirectoryA
DuplicateHandle
GetCurrentProcess
GetFileSize
ReadFile
FindFirstFileA
FindClose
GetLocalTime
GlobalMemoryStatusEx
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
GetModuleFileNameA
GetVersionExA
CreateFileA
WriteFile
ExitProcess
GetCurrentProcessId
ExitThread
CreateThread
GetTickCount
CancelIo
InterlockedExchange
SetEvent
Sleep
OutputDebugStringA
ResetEvent
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
lstrcpyA
WaitForSingleObject
CloseHandle
CreateEventA
VirtualFree
GetDriveTypeA
advapi32
AdjustTokenPrivileges
CloseEventLog
ClearEventLogA
StartServiceCtrlDispatcherA
OpenProcessToken
LookupPrivilegeValueA
ChangeServiceConfig2A
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenEventLogA
mfc42
ord540
ord800
ord6877
ord939
ord2818
ord4278
ord860
ord6663
ord858
ord535
ord922
ord924
ord926
ord4129
ord2764
ord6648
ord537
msvcrt
_stricmp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
strchr
_beginthreadex
free
realloc
strcmp
_access
strcat
strrchr
strncpy
_iob
fprintf
sprintf
printf
strcpy
time
srand
rand
atoi
_local_unwind2
_except_handler3
_CxxThrowException
memcmp
??2@YAPAXI@Z
strstr
memset
strlen
__CxxFrameHandler
_ftol
ceil
memcpy
??3@YAXPAX@Z
_strupr
_strcmpi
_controlfp
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteExA
shlwapi
PathRemoveFileSpecA
user32
wsprintfA
GetMessageA
GetInputState
PostThreadMessageA
GetWindow
GetWindowTextA
GetClassNameA
FindWindowA
wininet
InternetGetConnectedState
InternetOpenUrlA
ws2_32
setsockopt
sendto
socket
gethostbyname
htons
connect
send
recv
inet_ntoa
WSASocketA
htonl
gethostname
WSAGetLastError
inet_addr
WSAIoctl
select
closesocket
WSACleanup
WSAStartup
Exports
Exports
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE