Behavioral task
behavioral1
Sample
abc.exe
Resource
win7-20240903-en
General
-
Target
abc.exe
-
Size
3.8MB
-
MD5
f8da0c6f9d6e17d8f1ad1a826c1df770
-
SHA1
333b36b1b00eaf743a162492469b60fb6e91da0c
-
SHA256
18083d1596b1f6e1f96d7b8e33ecaa11d4aae7539a9764b18bfa25d74eb514a7
-
SHA512
812e0d29be38a3b0cdad3e8ca42e0b59ed453cdd9c0b7ce6935d8ee2b443789ea62f89ac3961a8967e2607235d41abd0a80d017a79e616e18624ddb1253cb11f
-
SSDEEP
98304:E8HxyU87A21uL/TypwLvZyzo55WuhtESKyP6EBYxczd:E8wDuL/uwLvZunu8SKyBBYQd
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
abc.exe.exe windows:5 windows x86 arch:x86
Code Sign
5d:b7:b8:b0:ce:f0:69:73:b9:f2:f9:36:e2:98:b1:ecCertificate
IssuerCN=Windows超级土狗Not Before01/04/2019, 11:50Not After31/12/2039, 23:59SubjectCN=Windows超级土狗03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate
IssuerCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22/10/2014, 00:00Not After22/10/2024, 00:00SubjectCN=DigiCert Timestamp Responder,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2021, 00:00SubjectCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
e4:17:c3:2e:3d:62:f8:70:cc:4f:b0:3e:1a:54:f8:bd:2b:8f:43:75:e6:7a:df:a8:2d:99:34:8e:cf:c2:5e:8dSigner
Actual PE Digeste4:17:c3:2e:3d:62:f8:70:cc:4f:b0:3e:1a:54:f8:bd:2b:8f:43:75:e6:7a:df:a8:2d:99:34:8e:cf:c2:5e:8dDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 328KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE