Behavioral task
behavioral1
Sample
1e45026107fe7a25e7de344db0d8e893534ec959a147182a395acebfeb420cb1.exe
Resource
win7-20240708-en
General
-
Target
0ef8d86d50e1e34031d46c1a202c927c.zip
-
Size
8.4MB
-
MD5
00f0e68432a027554a95c3a1f3eb87c1
-
SHA1
6c2d652d1c5c558bdf87b36c2f1e086d5dd40f5c
-
SHA256
8d68c2165601a00157c68fc656709db7c3394e632968ac4a8ecfa6aabf7de9cc
-
SHA512
4012d9a75381d0d3e59661a5dbcb7ae16b4dde909a5f0c7b6e20cb3883204f8e154ce714c61ec0c694bcf8fb1db6a0d1b1c2ca52cea0d3ed8392fab0dbfc5b9e
-
SSDEEP
196608:iAiV9EBqbiBHEsJCx1mh2MaF8hBQfW1nMBfsv7u4IIx40Iy6:iXEBqueJ1mzaF8Jgfs94jy6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/1e45026107fe7a25e7de344db0d8e893534ec959a147182a395acebfeb420cb1 upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1e45026107fe7a25e7de344db0d8e893534ec959a147182a395acebfeb420cb1
Files
-
0ef8d86d50e1e34031d46c1a202c927c.zip.zip
Password: infected
-
1e45026107fe7a25e7de344db0d8e893534ec959a147182a395acebfeb420cb1.exe windows:4 windows x86 arch:x86
Password: infected
9973fdd4b86d866b3faa39fa66cf7e0a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
ReadFile
GetWindowsDirectoryA
GetLastError
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
DeleteFileA
CreateMutexA
CreateFileA
CopyFileA
CloseHandle
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
user32
CharNextA
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE