5bff48c9f778467e46e5c0038e51bd82 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5bff48c9f778467e46e5c0038e51bd82
Size

563KB
MD5

5bff48c9f778467e46e5c0038e51bd82
SHA1

4afb6efaef26dbd34a9ee28e9f6169b765d2e378
SHA256

84f0fe9224869ccf04aaa3c83247a6fbd6475702b314472d29cdbb562dce4ef9
SHA512

e3dc5daa34441406004f09b5121778486dc78ae948a0d6817dfd9404649699b91302c1f6de754dc3e911ef51f22e9f4b3024437b3c0001b6e334a342a2444ab0
SSDEEP

12288:k4d2NSMlUJ1Il63bXAnqVhiRGaHWrl76iBmLyM3:r2NSMlUsl6rX6qHqGaHWR7Ux

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
static1/unpack001/yren-v2.09.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/yren-v2.09.exe

Files

5bff48c9f778467e46e5c0038e51bd82
.rar
yren-v2.09.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 288KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 233KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
新云软件.url
.url