Behavioral task
behavioral1
Sample
96a57a1d1c8977e657d8d8c0c8229025623b5870d6ab30b847b55d1d32a55ecc.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
96a57a1d1c8977e657d8d8c0c8229025623b5870d6ab30b847b55d1d32a55ecc.exe
Resource
win10v2004-20240802-en
General
-
Target
6917f92bb371ab6682fabba5e5cfb80a.zip
-
Size
38KB
-
MD5
b1437097e4278810b6441b49f645a16c
-
SHA1
ff1fbb782725ab8f23bd3adcb6c00ef51358553e
-
SHA256
45b8b330071a6a4e88fe8ad10f93c6928a08ad98c0703f2e9048799aa9a2157b
-
SHA512
22c47caf41e905ed0db37ac13b9d8848d0f70af8bd3ca27d24df2dd685807ccc65c93b3104b3f5c45f7b8dafd56881b36e81e518c7c47d806145ede1d5e1743c
-
SSDEEP
768:ZJYZRPnupBzL3H+pwNiGbf755t/MPYtvBmUx2VouYS4ccR8jRka+Titjqa9z31:ZJYZRPnu3zDuwpZ/MQtQUxRuYSvfqCF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/96a57a1d1c8977e657d8d8c0c8229025623b5870d6ab30b847b55d1d32a55ecc upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/96a57a1d1c8977e657d8d8c0c8229025623b5870d6ab30b847b55d1d32a55ecc unpack002/out.upx
Files
-
6917f92bb371ab6682fabba5e5cfb80a.zip.zip
Password: infected
-
96a57a1d1c8977e657d8d8c0c8229025623b5870d6ab30b847b55d1d32a55ecc.exe windows:5 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ