Behavioral task
behavioral1
Sample
4fabf6dee8d9c6786959cae5639b189d495674eda1ce6f9fe23e9fef696f865e.exe
Resource
win7-20240704-en
General
-
Target
4fabf6dee8d9c6786959cae5639b189d495674eda1ce6f9fe23e9fef696f865e
-
Size
101KB
-
MD5
cd1760bc4362c1b280023ac7de5c2808
-
SHA1
80c43e6ff33bf53a10378f31c43f263daee0a5be
-
SHA256
4fabf6dee8d9c6786959cae5639b189d495674eda1ce6f9fe23e9fef696f865e
-
SHA512
e7d6b92e89cd270f26a5ec2ff6aae1424257a05f74752682a868699d7ba543c0b0e6424502651a0f690597b9f16fde51a79f03f5ff8405e624835c7035264c6b
-
SSDEEP
1536:CTW7JJ7TkTmXadjUSbcDemTPAZk+cLtdNlb9PfESDOayxaJL:hI6W2QZwKS7V
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 4fabf6dee8d9c6786959cae5639b189d495674eda1ce6f9fe23e9fef696f865e unpack001/out.upx
Files
-
4fabf6dee8d9c6786959cae5639b189d495674eda1ce6f9fe23e9fef696f865e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ