Behavioral task
behavioral1
Sample
307fd2473bbe87ec23370dcf2944a4a0106f21c0286ffcf27026121f2fd92cbeN.exe
Resource
win7-20240903-en
General
-
Target
307fd2473bbe87ec23370dcf2944a4a0106f21c0286ffcf27026121f2fd92cbeN
-
Size
574KB
-
MD5
84dc9e5f85faf4b3a38813e35e289450
-
SHA1
d5b5eaa57b1bacedaec44723b5f3340936a800dc
-
SHA256
307fd2473bbe87ec23370dcf2944a4a0106f21c0286ffcf27026121f2fd92cbe
-
SHA512
ba3a40df870d0aba3987ee4f2993728fba4b69c8ef3661ca34945c068c343abcaf362716c21da4df122d267c1910b862e6208e53b08175c9291f77f0447eee7a
-
SSDEEP
6144:XV55pRPQdrFhbEhtVacLaN//2gWF6lxcg/I:XDDGdDbEh/a3tw
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 307fd2473bbe87ec23370dcf2944a4a0106f21c0286ffcf27026121f2fd92cbeN
Files
-
307fd2473bbe87ec23370dcf2944a4a0106f21c0286ffcf27026121f2fd92cbeN.exe windows:4 windows x86 arch:x86
5dc4d890d100a6a3aa07b5c431c18838
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetLocalTime
CreateThread
GlobalUnlock
GlobalLock
SetFileTime
GetFileTime
GlobalMemoryStatus
FindClose
FindNextFileA
FindFirstFileA
ReadFile
GetFileSize
GetCurrentProcess
TerminateProcess
OpenProcess
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
ExitThread
WriteFile
GetStartupInfoA
CreatePipe
GlobalAlloc
GetComputerNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetFileAttributesA
DeleteFileA
GetCurrentDirectoryA
GetLogicalDriveStringsA
TerminateThread
GetVersionExA
ExitProcess
GetTickCount
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetTempPathA
OpenMutexA
Sleep
CreateProcessA
CloseHandle
CreateMutexA
CopyFileA
PeekNamedPipe
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetVersion
GetCommandLineA
RtlUnwind
GetSystemTime
GetTimeZoneInformation
RemoveDirectoryA
advapi32
ControlService
RegDeleteKeyA
QueryServiceStatus
EnumDependentServicesA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetUserNameA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
user32
GetClipboardData
OpenClipboard
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
CloseClipboard
GetClassNameA
PostMessageA
EnumChildWindows
IsWindowVisible
EnumWindows
ExitWindowsEx
ShowWindow
MessageBoxA
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetCloseHandle
ws2_32
send
htons
inet_addr
gethostbyname
inet_ntoa
socket
connect
WSAStartup
closesocket
WSACleanup
getsockname
accept
select
listen
htonl
bind
gethostbyaddr
ntohl
WSASocketA
sendto
__WSAFDIsSet
setsockopt
WSAAsyncSelect
gethostname
WSAIoctl
recv
ntohs
Sections
UPX0 Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE