Behavioral task
behavioral1
Sample
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe
Resource
win10v2004-20241007-en
General
-
Target
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN
-
Size
116KB
-
MD5
78a2c00ce4d5fb7bfbc288cbfa7e0f70
-
SHA1
52a5f898b51aaf605865651761c9b114f562ab13
-
SHA256
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0c
-
SHA512
13cc6e9a4c2573ad52873628f0e77b058de0979c790809626f0a18fd208c99ec29e4311ff61b76eacc6e0e49791213907668b2fb6e93f1926e97ee7e4655edee
-
SSDEEP
768:SKNsqwRwJuzpAJwctzIGV988SobokX/BuGXtQ:rPoMuduXVGTKB
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN
Files
-
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe windows:4 windows x86 arch:x86
401f23ad085be3189cf3da81ebf9ed16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
WaitForSingleObject
CreateFileA
FreeLibrary
LoadLibraryExA
GetProcAddress
CloseHandle
GetLastError
CreateEventA
PulseEvent
DeleteFileA
ExitThread
GetModuleFileNameA
GetProcessHeap
lstrcpyA
lstrcatA
GetCurrentProcessId
GetCurrentProcess
GetModuleHandleA
LoadResource
ExitProcess
Process32First
LoadLibraryA
CreateToolhelp32Snapshot
CompareStringA
lstrlenA
SetEvent
ResetEvent
WaitForMultipleObjects
CreateThread
WriteFile
FindResourceA
advapi32
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegNotifyChangeKeyValue
RegCreateKeyExA
ole32
CoInitialize
CoUninitialize
shell32
SHGetFolderPathA
user32
CreateDesktopA
DispatchMessageA
SetThreadDesktop
ShowWindow
PeekMessageA
CreateWindowExA
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
wsprintfA
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE