Behavioral task
behavioral1
Sample
7dff004ae772361f9c4ec8502e0e740c9c89246e4eb84af05c0a88a7a06e9534N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7dff004ae772361f9c4ec8502e0e740c9c89246e4eb84af05c0a88a7a06e9534N.exe
Resource
win10v2004-20240802-en
General
-
Target
7dff004ae772361f9c4ec8502e0e740c9c89246e4eb84af05c0a88a7a06e9534N
-
Size
192KB
-
MD5
af44bcd296c3eb1194df1f931dfc9f20
-
SHA1
6aef3f116c8c3e31a884348645f5f0873a3d8ca3
-
SHA256
7dff004ae772361f9c4ec8502e0e740c9c89246e4eb84af05c0a88a7a06e9534
-
SHA512
7109fe3820da9de822d4f587d4e01136502f1a7a15880ba8103b7f3b33c1d060b13164c3ab354c7df822df38dc12eda47986d01d2740a4cbb04587b9f90021bd
-
SSDEEP
768:/vqS/ZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqjpLyIXLhpPyebISkKHtL0:/vq0LsF2Kerc64sTiX2IV0DEetoebdm
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7dff004ae772361f9c4ec8502e0e740c9c89246e4eb84af05c0a88a7a06e9534N
Files
-
7dff004ae772361f9c4ec8502e0e740c9c89246e4eb84af05c0a88a7a06e9534N.exe windows:4 windows x86 arch:x86
0831d5f0e903abd986bdf04d60189c9b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryW
MoveFileW
ReadFile
SetFilePointer
CreateFileW
WriteFile
GetDriveTypeW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
GetSystemDefaultLangID
GetTickCount
GetCurrentProcessId
GetComputerNameW
FreeLibrary
LoadLibraryW
GetVersionExW
GetCurrentProcess
OpenProcess
GetVolumeInformationA
Process32NextW
TerminateProcess
Process32FirstW
CreateProcessW
lstrlenW
SetFileTime
GetFileSize
DeleteFileW
Sleep
WinExec
GetModuleFileNameA
MultiByteToWideChar
PeekNamedPipe
GetStartupInfoW
CreatePipe
WaitForSingleObject
CreateThread
RemoveDirectoryW
GetTempPathW
ExitProcess
SetStdHandle
DuplicateHandle
WideCharToMultiByte
SetLastError
LoadLibraryA
GetModuleHandleA
CloseHandle
GetModuleFileNameW
SetErrorMode
FindClose
GetLogicalDriveStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
GetLastError
CreateToolhelp32Snapshot
GetStartupInfoA
advapi32
GetTokenInformation
RegDeleteValueW
RegSetValueExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LookupAccountSidW
GetUserNameW
RegOpenKeyW
msvcrt
_controlfp
__set_app_type
__p__fmode
swprintf
wcslen
wcscpy
memset
memcpy
??2@YAPAXI@Z
wcscmp
__CxxFrameHandler
_EH_prolog
wcscat
wcsrchr
_wcsnicmp
_except_handler3
_wcslwr
sprintf
strcpy
strcmp
rand
srand
strlen
time
atoi
free
_stricmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
psapi
EnumProcessModules
GetModuleFileNameExW
shell32
SHFileOperationW
shlwapi
PathFindFileNameW
PathFileExistsW
user32
ExitWindowsEx
Sections
UPX0 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE