Behavioral task
behavioral1
Sample
5b042deb337ba678a868f19a7c0c07ef1d1ae712cffceb6e6833441110d73630N.exe
Resource
win7-20240903-en
General
-
Target
5b042deb337ba678a868f19a7c0c07ef1d1ae712cffceb6e6833441110d73630N
-
Size
108KB
-
MD5
d7f8aaaaebe1cae2af20629d77d06a90
-
SHA1
4f675eeb00cbe860f8a12241d49175b6d9c52352
-
SHA256
5b042deb337ba678a868f19a7c0c07ef1d1ae712cffceb6e6833441110d73630
-
SHA512
9831d86e9ae499b47e9897caaeefe7311f291376512b5b9fbcd9040e6867c4ac347d8b902d3397a8ac0535ed33b99894a61ef6c0ecf228d9d38f10416bbe5b74
-
SSDEEP
3072:KQSox5KwjHSXIBlf08qySzCetFtJSuSSSskCTan:KQSox5KwgtJNTan
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 5b042deb337ba678a868f19a7c0c07ef1d1ae712cffceb6e6833441110d73630N unpack001/out.upx
Files
-
5b042deb337ba678a868f19a7c0c07ef1d1ae712cffceb6e6833441110d73630N.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ