Behavioral task
behavioral1
Sample
5e945fe2974ef070a33946fb64de3c67678101bd168fb441b5abcfced9be193e.exe
Resource
win7-20240704-en
General
-
Target
5e945fe2974ef070a33946fb64de3c67678101bd168fb441b5abcfced9be193e
-
Size
252KB
-
MD5
6b70053ab63beabd209761fa0d0c82d4
-
SHA1
48b87835ca5d6338eb2ecf8f6eb4e436fe6b8c33
-
SHA256
5e945fe2974ef070a33946fb64de3c67678101bd168fb441b5abcfced9be193e
-
SHA512
03d906a9f8ee4d71e4f2be2e8804a3e62f0c0c3a5704e356208131af92b3ab1c88a2940edc5b41ebec83ef129d52eab797a5aa7325b42d6e5556c39aabff23d8
-
SSDEEP
3072:dG9cAE8X5B4bN4vvlLh9nC3SLzMiqX0vnzgWoqVngT:dbQXkbNu9Hn4WjqXqnNo/T
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e945fe2974ef070a33946fb64de3c67678101bd168fb441b5abcfced9be193e
Files
-
5e945fe2974ef070a33946fb64de3c67678101bd168fb441b5abcfced9be193e.exe windows:4 windows x86 arch:x86
577a5f3c1840beeda679b15c1781a484
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
LocalReAlloc
LocalAlloc
GetFileSize
ReadFile
SetFilePointer
MoveFileA
CreateProcessA
InitializeCriticalSection
ExitProcess
WriteFile
CreateFileA
GetModuleFileNameA
lstrcmpiA
MapViewOfFile
CreateFileMappingA
HeapFree
UnmapViewOfFile
lstrcpyA
FindNextFileA
FindFirstFileA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
WaitForMultipleObjects
LocalSize
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetSystemInfo
GetComputerNameA
OpenEventA
SetErrorMode
CreateEventA
MoveFileExA
CreateDirectoryA
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileStringA
lstrcmpA
GetCurrentProcessId
GetLocalTime
GetTickCount
CancelIo
InterlockedExchange
ResetEvent
GetLastError
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
GetProcAddress
Sleep
CloseHandle
FreeLibrary
SetEvent
WaitForSingleObject
LoadLibraryA
GetModuleHandleA
LCMapStringW
LCMapStringA
SetStdHandle
FlushFileBuffers
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetCurrentProcess
RtlUnwind
RaiseException
HeapAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
TlsAlloc
SetLastError
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
advapi32
InitializeSecurityDescriptor
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
OpenProcessToken
GetTokenInformation
LookupAccountSidA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
RegCreateKeyExA
RegSetValueExA
OpenEventLogA
ClearEventLogA
CloseEventLog
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
ws2_32
__WSAFDIsSet
recvfrom
bind
getsockname
inet_ntoa
htonl
WSASocketA
WSAStartup
connect
inet_addr
send
closesocket
select
recv
socket
gethostbyname
htons
setsockopt
WSAIoctl
WSACleanup
sendto
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
Sections
UPX0 Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE