Behavioral task
behavioral1
Sample
417ffdc5a0506961fc3395d7bf0637874f39e18508ef07cd6b2f9daeffebe45fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
417ffdc5a0506961fc3395d7bf0637874f39e18508ef07cd6b2f9daeffebe45fN.exe
Resource
win10v2004-20240910-en
General
-
Target
417ffdc5a0506961fc3395d7bf0637874f39e18508ef07cd6b2f9daeffebe45fN
-
Size
34KB
-
MD5
414e99bb066458c00b98e1bd9828e8c0
-
SHA1
eb4515dc13dd9ac32e11cbdf84463b21de2ea0f2
-
SHA256
417ffdc5a0506961fc3395d7bf0637874f39e18508ef07cd6b2f9daeffebe45f
-
SHA512
caf95135af2527332d3f3f450f0cf827d053ae58b30d9e483decf2e54d7fd01fbc8e79a691fa3cab253dc2cf276501a31a78288c1e1072435db0eec2d7f168de
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9KY1Y9B0zB0v:CTW7JJ7TIB0zB0v
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 417ffdc5a0506961fc3395d7bf0637874f39e18508ef07cd6b2f9daeffebe45fN unpack001/out.upx
Files
-
417ffdc5a0506961fc3395d7bf0637874f39e18508ef07cd6b2f9daeffebe45fN.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ