Behavioral task
behavioral1
Sample
e6fbafcb4b396f7bb06287aa1b13d6c7f94d454a3a0f123d6eeed212fc76fdd2N.exe
Resource
win7-20240729-en
General
-
Target
e6fbafcb4b396f7bb06287aa1b13d6c7f94d454a3a0f123d6eeed212fc76fdd2N.exe
-
Size
269KB
-
MD5
2ba4d13b830b3e02575c20b1dbfdd6e0
-
SHA1
3da870d0e0492b4b90931834e4cf19693603981e
-
SHA256
e6fbafcb4b396f7bb06287aa1b13d6c7f94d454a3a0f123d6eeed212fc76fdd2
-
SHA512
eb484bbe76ec40819f72ecc1353161bf4e038bad5d4f0539234aba337cc20a405d3b5610f2d51beee99ee38c332fe7f63288afb6abfad0d0bac43229b40a3423
-
SSDEEP
3072:iAn6oNA5f/hK9eb+iY86PLJ83pBw0q6FjctDuFbIbXuUZayuNmhofrwr2LDDHyt2:iA6aAv+5iYPEzF0ZZay/ofrwr0DDHC2n
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6fbafcb4b396f7bb06287aa1b13d6c7f94d454a3a0f123d6eeed212fc76fdd2N.exe
Files
-
e6fbafcb4b396f7bb06287aa1b13d6c7f94d454a3a0f123d6eeed212fc76fdd2N.exe.exe windows:4 windows x86 arch:x86
98fd8531e35ad97105c4cde0485643dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
WaitForMultipleObjects
LocalFree
LocalAlloc
SetEvent
CreateEventW
InitializeCriticalSection
GetFileAttributesW
GetCurrentProcess
MoveFileW
SetErrorMode
WaitForSingleObject
GetSystemInfo
QueryPerformanceFrequency
GetModuleHandleW
GetTickCount
GetModuleFileNameW
OpenEventW
Sleep
LoadLibraryW
FreeLibrary
GetLastError
GetVersionExW
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
RaiseException
LoadLibraryA
lstrcmpW
GetProcAddress
advapi32
SetThreadToken
ImpersonateLoggedOnUser
RevertToSelf
QueryServiceConfigW
CreateServiceW
ChangeServiceConfigW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
ControlService
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
DuplicateTokenEx
loadperf
SetServiceAsTrustedW
UpdatePerfNameFilesW
SetServiceAsTrustedA
kbdest
KbdLayerDescriptor
Sections
UPX1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yNSNYs Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Qg Size: 4KB - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.GVtccp Size: 4KB - Virtual size: 445KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 90KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.acwcX Size: 1024B - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 128KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WjOb Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ