Behavioral task
behavioral1
Sample
定时关机.exe
Resource
win7-20240903-en
General
-
Target
63a71d083d429f660968bcb52700c9ca5db67f1d3540cda3a8d080b705332b2c
-
Size
2.1MB
-
MD5
78c28339aa917d8007e6bb986158c94e
-
SHA1
c86a9e2a66f50898fac894d28fec8f34b379a8a4
-
SHA256
63a71d083d429f660968bcb52700c9ca5db67f1d3540cda3a8d080b705332b2c
-
SHA512
f3ccb2980c8be40131339faece8b172384ccb67f30394cfefd613d8a7fb54176497398bad69d7bceef0177b992f70fe8095382430b14b2280e989b881b1b920b
-
SSDEEP
49152:uisItMxkXj/Lw63dksfQt9K5XbHRTgSZ4YW2wXRcR1:XOxELwudksfHXtTgM4YWfXR6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/定时关机.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/定时关机.exe
Files
-
63a71d083d429f660968bcb52700c9ca5db67f1d3540cda3a8d080b705332b2c.zip
-
config.db
-
定时关机.exe.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 78KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE