ad1a7021107016bad55ca8c4c222ca9e

Sharing

Copy URL Twitter E-mail

General

Target
ad1a7021107016bad55ca8c4c222ca9e
Size 1.8MB
Sample240228-27nmqagb59
SHA256 4b7bb7baa5c1ab4c1f1fb5263b49def81c0a8a2d91a791c1424ecdf3a7314b9c
MD5 ad1a7021107016bad55ca8c4c222ca9e
SHA1 db7faeadeb3ec0daa0b8f40353c825a86122cdc5
SHA512 01a19c0e998138ea6a2e102413cbc66a793daf4e3f82a47acc4e1730d3d809d256b3e3c7e23ae3e630834640a823f7195f4a95cad76a10f8bd38223b1007c3d7
SSDEEP 49152:adUNBjuAULQrAJgrX09+yZMAMuaoxn2NM:auNBjuXLQrAOAPZDMuJkS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/Office 电子日记/OfficeDiary.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Office 电子日记/OfficeDiary.exe

File Explorer

ad1a7021107016bad55ca8c4c222ca9e

.rar 1.8MB
Office 电子日记/OfficeDiary.chm

.chm 14KB
Office 电子日记/OfficeDiary.exe

.exe .ps1 1.9MB
Office 电子日记/readme.txt

937B
Office 电子日记/新云软件.url

.url 133B

ad1a7021107016bad55ca8c4c222ca9e

SHA256 4b7bb7baa5c1ab4c1f1fb5263b49def81c0a8a2d91a791c1424ecdf3a7314b9c
MD5 ad1a7021107016bad55ca8c4c222ca9e
SHA1 db7faeadeb3ec0daa0b8f40353c825a86122cdc5
SHA512 01a19c0e998138ea6a2e102413cbc66a793daf4e3f82a47acc4e1730d3d809d256b3e3c7e23ae3e630834640a823f7195f4a95cad76a10f8bd38223b1007c3d7
SSDEEP 49152:adUNBjuAULQrAJgrX09+yZMAMuaoxn2NM:auNBjuXLQrAOAPZDMuJkS
MD5 SHA1 SHA512 SSDEEP

Office 电子日记/OfficeDiary.exe

SHA256 3995b2b98cd4ac1589dd66807fce14ae776d9b660e9c4f2a605403184accfe94
MD5 5beb63abba0c8eb5fe8dd521e7d0eaf7
SHA1 13da7ed698347c74731fc698a0cd2f57df782414
SHA512 217d7388afcfddff4f24453d669cf2fac262ccb2ddadc61d94599b325669efc8b516fccd47bece402f9e538c0a794df881bb8a139c681afb67e7eba53943c73b
SSDEEP 49152:9qc5NINQuZ5dl16lHiyGfqKB7S2Z6X1wTPk6DtEaZS+pG:9qkSNZZzl1VnhNelwT9tEGG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86 polyglot

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6156289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

1.2MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

35KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

645KB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

21KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

ad1a7021107016bad55ca8c4c222ca9e

Office 电子日记/OfficeDiary.chm

Office 电子日记/OfficeDiary.exe

generic

Office 电子日记/readme.txt

Office 电子日记/新云软件.url