Behavioral task
behavioral1
Sample
98b3ef0ef64cbce1a4ff224bacd2be70N.exe
Resource
win7-20240708-en
General
-
Target
98b3ef0ef64cbce1a4ff224bacd2be70N.exe
-
Size
124KB
-
MD5
98b3ef0ef64cbce1a4ff224bacd2be70
-
SHA1
ce3da642ff055bf0c7b01e1fe54d55b0716671c2
-
SHA256
4012693627b5877e382fd4be9f4675dd7f08090a8b56b89f5f0277ae7d13458b
-
SHA512
096c11e14529eb641b52da24b29dadae51e49eea64e76651006fd0cc9b39712e69ccab32b1bf76841e349141e32c16e6205646e5c2e7e2c46825256aaf230495
-
SSDEEP
384:EI6SMmDpPNg3AhVC2PJ6wRC8vPpMiuMZkVo+TZo7bIEuiI8LbRKvsYJtuigBe68Y:EIpMSplQCLP5uK6loNupKYsTicUtcUq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98b3ef0ef64cbce1a4ff224bacd2be70N.exe
Files
-
98b3ef0ef64cbce1a4ff224bacd2be70N.exe.exe windows:4 windows x86 arch:x86
70a180ed5c69fedb001d70445a0d7a68
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapReAlloc
InterlockedExchange
ExitProcess
GetModuleHandleW
GetModuleHandleA
GetTickCount
HeapFree
RaiseException
RtlUnwind
lstrcpynA
LoadLibraryA
LCMapStringA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
comctl32
ord17
user32
PostQuitMessage
SendMessageA
DestroyWindow
DefWindowProcA
PostMessageA
CreateWindowExA
ShowWindow
UpdateWindow
LoadCursorA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA
Sections
UPX0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE