Behavioral task
behavioral1
Sample
0fca043ce6592269f8463ec4c803eabb3d09ff412401521090513e8310463fdb.exe
Resource
win7-20240708-en
General
-
Target
484d55075f86c767a3347c1e60cd7a86.bin
-
Size
529KB
-
MD5
965100655c2ad0c558eb331b6cc0d1c5
-
SHA1
d97319618f70fdddba9a2f3016bcd10716073f47
-
SHA256
3bb14435f49a8c1ecdd695fe17d9653fa641ca87387e00a023a4e84105bde6bc
-
SHA512
f5b74b505943a2680db8573003b62fe481e665cd1173ae97e45bac1ace4b20b0c5839f5fe8493451f41d32a6d559a07f9730354698916d3342d9657aa64afb32
-
SSDEEP
12288:b680ZIifSlHn/dA4n7bi+NLv0m4lFavUg4Uvr6CKIuQ/w6LgniR:niKlHVA4nvJcmkMvGamCKIuQVgniR
Malware Config
Signatures
-
resource yara_rule static1/unpack001/0fca043ce6592269f8463ec4c803eabb3d09ff412401521090513e8310463fdb.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/0fca043ce6592269f8463ec4c803eabb3d09ff412401521090513e8310463fdb.exe unpack002/out.upx
Files
-
484d55075f86c767a3347c1e60cd7a86.bin.zip
Password: infected
-
0fca043ce6592269f8463ec4c803eabb3d09ff412401521090513e8310463fdb.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 760KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 529KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ