Behavioral task
behavioral1
Sample
f7c5cc04f4e57ec499416118cc8469317b95d70b7aeebbc78b09e10839164f19.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f7c5cc04f4e57ec499416118cc8469317b95d70b7aeebbc78b09e10839164f19.exe
Resource
win10v2004-20241007-en
General
-
Target
f7c5cc04f4e57ec499416118cc8469317b95d70b7aeebbc78b09e10839164f19
-
Size
144KB
-
MD5
05d780c25bc9c8f5d980460787bcb398
-
SHA1
dc1811481377a3490fbb407a63351954de4ec755
-
SHA256
f7c5cc04f4e57ec499416118cc8469317b95d70b7aeebbc78b09e10839164f19
-
SHA512
e69b0fcfb3414b5dc96c21479d651feaf90e35fff4c343c731291c1fc6b226ec5f36f4299ac55cb2e40538511e209ec6b889764b312130c287dc0749716472b2
-
SSDEEP
768:neLwUJrxBAGiQRFUxzfYaeJgDPwjRTUY:ekEr/AGioyzgZg8jRo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7c5cc04f4e57ec499416118cc8469317b95d70b7aeebbc78b09e10839164f19
Files
-
f7c5cc04f4e57ec499416118cc8469317b95d70b7aeebbc78b09e10839164f19.exe windows:4 windows x86 arch:x86
3b03c3d1aa4901bdc7aa37dedab2c359
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetModuleHandleA
GetCommandLineA
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
Process32Next
CloseHandle
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
FindFirstFileA
WritePrivateProfileStringA
WaitForSingleObject
CreateEventA
LoadLibraryA
Sleep
MoveFileExA
GetPrivateProfileStringA
GetWindowsDirectoryA
msvcrt
rand
srand
time
fclose
fwrite
fopen
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
rename
_strlwr
Sections
UPX0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE