1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5

General

Target
1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5
Size 3.6MB
Sample221101-nw56qsbeh7
SHA256 1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5
MD5 a67ddc12ca24183e9555736e916744f5
SHA1 65d49365778b5e9e68715d2d2a591e80c3f6896f
SHA512 d341f9c93b365f85ba2db6b53c81e90428e5d0e5de33197b70d9987a13d1c1fa0bbf94ae633418deace08213deabb4e9a22074f082de313b6b8ec2ffe7439959
SSDEEP 98304:PmnwoN6xSPW1c3ZbO0PnmGfUPKreB8p61:Pmnw3oWqZbO0PmG2D1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/flash.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

File Explorer

1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5

.zip 3.6MB
flash.exe

.exe 3.6MB
out.upx

.exe 650KB

1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5

SHA256 1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5
MD5 a67ddc12ca24183e9555736e916744f5
SHA1 65d49365778b5e9e68715d2d2a591e80c3f6896f
SHA512 d341f9c93b365f85ba2db6b53c81e90428e5d0e5de33197b70d9987a13d1c1fa0bbf94ae633418deace08213deabb4e9a22074f082de313b6b8ec2ffe7439959
SSDEEP 98304:PmnwoN6xSPW1c3ZbO0PnmGfUPKreB8p61:Pmnw3oWqZbO0PmG2D1
MD5 SHA1 SHA512 SSDEEP

flash.exe

SHA256 707b25f82349269b4783b27284a71824ffd0cb9f48061a701332366b777d56c2
MD5 e95a702e043ccb733509f91eb8c088ce
SHA1 17afe37f9dc376f574ba76e0fcb4e9dcb8b87889
SHA512 7f979d333e497ddbba7cf0b921343dbe922665f3a59d4d345a0a6b58bf4b80078b778bb32d5f05921358b9d3b19e0a60c2c12de5661accbcfade4db282457124
SSDEEP 98304:ASLCd6gfyNwvgJcPzROI9neqpoP8jGZ8H2M:JLCd6DWgszROI9eq4zM
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

776848

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 8868d778b4e7cf5354923eda1d1ec5c0f9d486329f07e90d4e271e7f93f7f4ca
MD5 b6a871c62e27defb6b282975ee254ccb
SHA1 daf9ce8bca2edf2bc423517a54597e1c5a7cd294
SHA512 8a6d6ff93e49eb134b48b6b21e18f16cf0fc27ea58e805bb4dcfd518bbbaa54fb6c5495a2b0efd05bc2a0d571a1e5600468709736930559ff18ef0737fb843f3
SSDEEP 12288:9aWzgMg7v3qnCiMErQohh0F4CCJ8lny3yS3OE:caHMv6Corjqny3Z
MD5 SHA1 SHA512 SSDEEP

windows x86

AutoIT Executable

AutoIT scripts compiled to PE executables.

Minor OS version

Major OS version

Entry point

90896

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

1d8ba08513eb5bdabd161ca77e04a0315328b3f6d1ffa9f09e6280225da458c5

flash.exe

out.upx