Behavioral task
behavioral1
Sample
skibidi skid who shall i steal today.exe
Resource
win7-20241010-en
General
-
Target
skibidi skid who shall i steal today.exe
-
Size
227KB
-
MD5
8f0d6e03ee2f791e3270d682778c4a3c
-
SHA1
0f796d86fc10b2170d4e2875ae4bb7c157c01f67
-
SHA256
9eefe406aa13dcf0b6e144ac5c78233fca22d813e22091dcfdc13deb82ca1925
-
SHA512
f3c2521ff9a44cffa41800cf208c3230610bcd6037f76b9220880790106fa0adfea7d626c4aaf7ef4d15136296b5ee2c9fd03e1fde7fde63a74174021db3d2f1
-
SSDEEP
6144:+loZM+rIkd8g+EtXHkv/iD4BC1bbhS6FAAxDeeb3k2+lb8e1mnwi:ooZtL+EP881bbhS6FAAxDeeb3ktCp
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1296917578299478146/UJbiFDKAmfwXq8YVnbljtTQH4X9kuOdtEdG7wXePOW6My9ASOTzRLNkBwdY4C9qTKXzd
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource skibidi skid who shall i steal today.exe
Files
-
skibidi skid who shall i steal today.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ