Overview

overview

10

Static

static

10

ad1c172699...28.exe

windows7-x64

10

ad1c172699...28.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ad1c1726998edecce7f7430e2c3b07a70381bacc0829163ef77291f7aed97b28.exe.compressed

  • Size

    442KB

  • MD5

    7678d93cc233353c7cd40a4813f495de

  • SHA1

    5656ef7600dd5ac80d7b5852a41a7184d0a090c9

  • SHA256

    9f31d7b4da89bedf3cc92421fa69368763361015bb0ac3665feb38432c8fbf49

  • SHA512

    f60e4f89bd1b8ef35b36a61c60f5a3cb6cc3d3311853be7e3a903c9c2a4f8b82dca3f2a284e4bdcac081bd53df2a1a90bf63aa652f993a030fe91d9d99a7652c

  • SSDEEP

    3072:JFHCuFdjX3nEnZjLo3ChirBtRix4wBblxgNuhPXHrJTkzlLH0vx7fGNY4LOOFHyD:TiMjX3En9o3Chide4wlP5HrJTNelKO

Score
10/10
upx

Malware Config

Signatures

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • ad1c1726998edecce7f7430e2c3b07a70381bacc0829163ef77291f7aed97b28.exe.compressed
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections