Behavioral task
behavioral1
Sample
xf-adesk20.exe
Resource
win7-20240903-en
General
-
Target
xf-adesk20.7z.zip
-
Size
577KB
-
MD5
7187b2d52b698bf943f4e3037eb74363
-
SHA1
89ba96484a2518b93b5eb8a8d09f117d79f4bef9
-
SHA256
637358b50b0b2ea6a6e7c89224d32c2c8c9699561eee99115508dbd542221b8f
-
SHA512
a270cf5c44569c96db6d03e27cb247316093b495978ad2e7d9b358ebe5de604bb75c7c14042c5902c5307c4ed706d77e0e4a830a648037bf5286b93bb81599ac
-
SSDEEP
12288:pLl5RnvhrPAuuuyK2eZbDZWfbXqzmWJsSWptYSuNddH+22uR:plprTuuyK2eZPsfbXqS59tMLdH+2N
Malware Config
Signatures
-
resource yara_rule static1/unpack002/xf-adesk20.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/xf-adesk20.exe
Files
-
xf-adesk20.7z.zip.zip
Password: infected
-
xf-adesk20.7z.7z
Password: infected
-
xf-adesk20.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 574KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE