1c52f54e963b189b2d1e2999f88f24b667b4d65c83875541019a96d96117292b
- SHA256 1c52f54e963b189b2d1e2999f88f24b667b4d65c83875541019a96d96117292b
Password
infected
Behavioral task
behavioral1
Sample
160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 1c52f54e963b189b2d1e2999f88f24b667b4d65c83875541019a96d96117292b
- Size 168KB
- Sample241109-ykff2stmem
- SHA256 1c52f54e963b189b2d1e2999f88f24b667b4d65c83875541019a96d96117292b
- MD5 7270088fbda96fede755406540173375
- SHA1 0fc31a97416819272d9b1104eb2fb5fdfede4105
- SHA512 84c7ea64cfdf135374350bffe301038fc55259f2fec82bbd8e076f91d14156a4786b36aa3a42f008bb3973491b33b9a01ce174dd435e8378a1775c3b57f9350f
- SSDEEP 3072:4ljIj4s21+L9YMSW5a8qTcmdb4MUpydw8ICdClAK2YerCGYXPv0iWLOSbp96nwG/:qk4s21YOMSW5aNTcoOs7ICk9de5U0lOD
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe unpack002/out.upx
File Explorer
-
1c52f54e963b189b2d1e2999f88f24b667b4d65c83875541019a96d96117292b.zip 168KB
-
160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe.exe 173KB
-
out.upx.exe 492KB
160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
- SHA256 160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2
- MD5 1e2802760f0b07c1290456694ebf5423
- SHA1 9a3a72436ac7d49aeedad5b4eae74173cd8dcb41
- SHA512 197882aa57c2dba7a827f3d0b04428c9d31c09a184b51a0f4dac9a6d47e6127a02fec195d2ac96d72bd8726917e360c985ea698c55e5b45b065f6b8dd0e19b0f
- SSDEEP 3072:7TQnFeJSrE+G7HRT+rnnDdSzOXueSX5xU5vcOdJRY8pvNBGxEYTlzCS/u:75MrER4nnhyOXs5xETdJRY8ZNBGnXu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
527136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
171KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=68, id=170, productName=VS2010 build 30319, version=30319,
count=29, id=171, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
out.upx
- SHA256 aa5d93351d82de093ecc27a45b9261c369c4d1db128b2d46f2b76b14589245bc
- MD5 da79b7b3812222326f6fe16357070fa1
- SHA1 01dac781d526c7d30e68ac320c235dc5f13d983f
- SHA512 a1b40c4b07c25c214f0cf9e5c7c018876256598e1db4c4815a34c16020d2a87f25c69c74b22b68cf496b8954888ebeb26804d367e9cb8897c70ce28e37b173d5
- SSDEEP 12288:/4I9wRIifNv1mwyB3a1mwyB3s8owFLz4YIf0gv919ymJf3XbMmmLP:/d9wfaFLkf0gXZvImmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12872
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
439KB
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=68, id=170, productName=VS2010 build 30319, version=30319,
count=29, id=171, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,