Behavioral task
behavioral1
Sample
f44e4c9378e97a73e187a1b5fe20b100N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f44e4c9378e97a73e187a1b5fe20b100N.exe
Resource
win10v2004-20240802-en
General
-
Target
f44e4c9378e97a73e187a1b5fe20b100N.exe
-
Size
192KB
-
MD5
f44e4c9378e97a73e187a1b5fe20b100
-
SHA1
21bead30e7506315ef88052d5ef835187baba9ac
-
SHA256
4d7458d5a8bf1bcfdbbc32159f0f9ae8e223dcd1baf31bd090691a3ed665be5d
-
SHA512
b4bbda3154e18fecbd6d9b3e02b49cb7b53cea7e54ebe3cd2b54a85f2d9279b88cbc030911d2b3a28d617e1cc296ac5612618e178c4a525247fce4bfab28bd01
-
SSDEEP
768:/vqS/ZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqjpLyIXLhpPyebISkKHtLw:/vq0LsF2Kerc64sTiX2IV0DEetoebde
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f44e4c9378e97a73e187a1b5fe20b100N.exe
Files
-
f44e4c9378e97a73e187a1b5fe20b100N.exe.exe windows:4 windows x86 arch:x86
0831d5f0e903abd986bdf04d60189c9b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryW
MoveFileW
ReadFile
SetFilePointer
CreateFileW
WriteFile
GetDriveTypeW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
GetSystemDefaultLangID
GetTickCount
GetCurrentProcessId
GetComputerNameW
FreeLibrary
LoadLibraryW
GetVersionExW
GetCurrentProcess
OpenProcess
GetVolumeInformationA
Process32NextW
TerminateProcess
Process32FirstW
CreateProcessW
lstrlenW
SetFileTime
GetFileSize
DeleteFileW
Sleep
WinExec
GetModuleFileNameA
MultiByteToWideChar
PeekNamedPipe
GetStartupInfoW
CreatePipe
WaitForSingleObject
CreateThread
RemoveDirectoryW
GetTempPathW
ExitProcess
SetStdHandle
DuplicateHandle
WideCharToMultiByte
SetLastError
LoadLibraryA
GetModuleHandleA
CloseHandle
GetModuleFileNameW
SetErrorMode
FindClose
GetLogicalDriveStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
GetLastError
CreateToolhelp32Snapshot
GetStartupInfoA
advapi32
GetTokenInformation
RegDeleteValueW
RegSetValueExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LookupAccountSidW
GetUserNameW
RegOpenKeyW
msvcrt
_controlfp
__set_app_type
__p__fmode
swprintf
wcslen
wcscpy
memset
memcpy
??2@YAPAXI@Z
wcscmp
__CxxFrameHandler
_EH_prolog
wcscat
wcsrchr
_wcsnicmp
_except_handler3
_wcslwr
sprintf
strcpy
strcmp
rand
srand
strlen
time
atoi
free
_stricmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
psapi
EnumProcessModules
GetModuleFileNameExW
shell32
SHFileOperationW
shlwapi
PathFindFileNameW
PathFileExistsW
user32
ExitWindowsEx
Sections
UPX0 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE