Behavioral task
behavioral1
Sample
af016ddeda82e1a639ce1f923315063f22a6d5ff8fa87c12ed1bdfffdc2d1dcf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
af016ddeda82e1a639ce1f923315063f22a6d5ff8fa87c12ed1bdfffdc2d1dcf.exe
Resource
win10v2004-20241007-en
General
-
Target
af016ddeda82e1a639ce1f923315063f22a6d5ff8fa87c12ed1bdfffdc2d1dcf.exe
-
Size
29KB
-
MD5
225fcf31212cb2fd996cf28cb0321ad0
-
SHA1
51c65810e28026f3a0e4a2bdd04f6bb07dc6a8b6
-
SHA256
af016ddeda82e1a639ce1f923315063f22a6d5ff8fa87c12ed1bdfffdc2d1dcf
-
SHA512
97bcca925442462230595fc41674ff97b3f6e341f734967effe3e02a946ca31d12c1ad3c37b745a7968b8886b2b15d4cc49aca6a5fb23c3b3d827c6297b560fd
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/0:AEwVs+0jNDY1qi/qc
Malware Config
Signatures
-
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource af016ddeda82e1a639ce1f923315063f22a6d5ff8fa87c12ed1bdfffdc2d1dcf.exe
Files
-
af016ddeda82e1a639ce1f923315063f22a6d5ff8fa87c12ed1bdfffdc2d1dcf.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 511B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE