Behavioral task
behavioral1
Sample
2ef4f45dd4a0f98fd36582c3088c797e7d840841fc7fbab85eb3952b8d5da798.exe
Resource
win7-20240903-en
General
-
Target
2ef4f45dd4a0f98fd36582c3088c797e7d840841fc7fbab85eb3952b8d5da798
-
Size
5.3MB
-
MD5
367e673610022c76dc5f8a460e8e1e02
-
SHA1
d98c9767ae13212fe6387d8d1daea0109e0989bc
-
SHA256
2ef4f45dd4a0f98fd36582c3088c797e7d840841fc7fbab85eb3952b8d5da798
-
SHA512
53320c19b250d3365e20ace7b7d18388291e91fbeb721756acba6ce40496c1baa9d4511138b89cdcc0e9d751266d11c8367869fde7cab84c4999f3c0f629deca
-
SSDEEP
49152:tjNK9Y786L8Xr6yZBY5l71+SMgyD1HGmBYcS9qm98X1QjdImEhPq:tj4neyZBU7wSMgyJHGmy9i2jd0hS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ef4f45dd4a0f98fd36582c3088c797e7d840841fc7fbab85eb3952b8d5da798
Files
-
2ef4f45dd4a0f98fd36582c3088c797e7d840841fc7fbab85eb3952b8d5da798.exe windows:5 windows x86 arch:x86
d7bbd1b5b14bf90c883f9f4b76c3e399
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
advapi32
RegEnumKeyA
gdi32
BitBlt
gdiplus
GdipFree
imm32
ImmGetContext
msimg32
AlphaBlend
ole32
DoDragDrop
oleacc
LresultFromObject
oleaut32
SysAllocStringLen
oledlg
ord8
shell32
DragFinish
shlwapi
PathIsUNCA
user32
GetDC
uxtheme
IsAppThemed
winmm
PlaySoundA
winspool.drv
GetJobA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
UPX0 Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 757KB - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 77KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ