Overview

overview

7

Static

static

7

phpwindlyg...��.htm

windows7-x64

1

phpwindlyg...��.htm

windows10-2004-x64

1

phpwindlyg...ts.exe

windows7-x64

7

phpwindlyg...ts.exe

windows10-2004-x64

7

phpwindlyg...��.url

windows7-x64

1

phpwindlyg...��.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    36054c94492a6d5d656c0654f7a0c257

  • Size

    617KB

  • MD5

    36054c94492a6d5d656c0654f7a0c257

  • SHA1

    35fbde7daa48cea1d950171c7c032ea9b54d7c12

  • SHA256

    4a8226b59c215dccdb092b4d6618b7e40381dc4e3da790885359203c0f10c5c2

  • SHA512

    1d9013ad909914a9aaed13df065abf3a6918269e781937117d49f326dc703cbe46a90470ae69b743bab0416e4df7f301ee0311a41da0c8467df8329d13ed16e1

  • SSDEEP

    12288:SyJDyaGKNiqPDO/ivusrVYKmIjlFscTKTM/y/9tRDo:5NyavNiqSqdrVYiXKP9H8

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 36054c94492a6d5d656c0654f7a0c257
    .zip
  • phpwindlygj/##ע##.txt
  • phpwindlygj/77169.orgʹð˵.txt
  • phpwindlygj/77169.org˵.htm
    .html
  • phpwindlygj/PWind 5[1].x Exploits.exe/PWind 5.x Exploits.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • phpwindlygj/PWind 5[1].x Exploits.exe/boardlist.txt
  • phpwindlygj/PWind 5[1].x Exploits.exe/readme.txt
  • phpwindlygj/ĺڿͬ.url