Behavioral task
behavioral1
Sample
50ee9c9c41fc55429af4334551f4cb47f8d24941075bc40b5fd2ae18d2698e42.exe
Resource
win7-20240903-en
General
-
Target
50ee9c9c41fc55429af4334551f4cb47f8d24941075bc40b5fd2ae18d2698e42
-
Size
3.0MB
-
MD5
8be8387a8d8c28c15ceb8b1db87ab131
-
SHA1
0f0d482613a77daf9b2c007f3b1e6be9e42c179e
-
SHA256
50ee9c9c41fc55429af4334551f4cb47f8d24941075bc40b5fd2ae18d2698e42
-
SHA512
343da54f2cfe03f259b6c57307dcd71358c3ba87d95072b72752928b6183911c7d63a4b08a4e15b7387c26a34bef603de1e14eac94e83af2c1e5656a4da9b7b1
-
SSDEEP
98304:BdqVJxPt1MKHCFu0micmLqnJeqNnSu9jwlX4R:qVJxPzMKHCgdmmJxWk
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 50ee9c9c41fc55429af4334551f4cb47f8d24941075bc40b5fd2ae18d2698e42 unpack001/out.upx
Files
-
50ee9c9c41fc55429af4334551f4cb47f8d24941075bc40b5fd2ae18d2698e42.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ