Behavioral task
behavioral1
Sample
0cc80b840c8b500dd996008083617230N.exe
Resource
win7-20240708-en
General
-
Target
0cc80b840c8b500dd996008083617230N.exe
-
Size
176KB
-
MD5
0cc80b840c8b500dd996008083617230
-
SHA1
9242bc6b57ac2780bfb22240da2cb4f2eb3548b2
-
SHA256
bd5bead73350622dd47e3364ce5e662494f351cf1410abd981e57123d84a56b4
-
SHA512
d83a300f2454f5b571300887298a6fca77cc8d293bf14cf33905dd0a8f24d8fa341a07aa92c2df2869eae3555339ed3ef869c4afa4410330992bd62cd0b9c084
-
SSDEEP
1536:6Ue9GX56ntoD8NLR+gsgHb3haXf2FljvcsU9RL7liS4gZe+B5mk+LOxn5LUrQ7U1:5e93pFQCgsU9lySeg5mBixZJY09y
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cc80b840c8b500dd996008083617230N.exe
Files
-
0cc80b840c8b500dd996008083617230N.exe.exe windows:5 windows x86 arch:x86
c41d10fa42d047a15d4c30634f716db8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
CreateFileA
GetFileSize
FindResourceA
SetFilePointer
LoadResource
Process32First
GetTickCount
VirtualFree
WriteFile
GetCommandLineA
OpenProcess
GlobalAlloc
Thread32First
TerminateThread
Sleep
SizeofResource
TerminateProcess
Thread32Next
ReadFile
GetSystemDirectoryA
lstrcatA
MultiByteToWideChar
VirtualAlloc
CopyFileA
GlobalFree
OpenThread
Process32Next
MoveFileA
GetModuleFileNameA
GetModuleHandleA
CreateToolhelp32Snapshot
WinExec
CloseHandle
GetCurrentProcessId
lstrcpyA
ExpandEnvironmentStringsW
msvcrt
memcpy
wcsstr
srand
_stricmp
memset
strstr
rpcrt4
UuidCreate
shell32
ShellExecuteA
user32
CharLowerW
wsprintfW
wsprintfA
ws2_32
WSCWriteProviderOrder
WSCEnumProtocols
WSCDeinstallProvider
WSCGetProviderPath
WSCInstallProvider
Sections
UPX0 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE