ab94319787a2ae83dba8119d18363e43

Sharing

Copy URL Twitter E-mail

General

Target
ab94319787a2ae83dba8119d18363e43
Size 1.2MB
Sample240228-lltzlsgd5w
SHA256 ba094783ed8a2b979d7afd838b38d12022ebdb267e0cd14d392f5ddb70c458e3
MD5 ab94319787a2ae83dba8119d18363e43
SHA1 0c6e25d6fa97271e7a0fa92b57c81286db2dad86
SHA512 38ca4ba8e09a5cd397c615dddc3ee888223049c515cc368397d2fcc89912474748928fd13eb22d806151e7d136e3f5048e1eeb693681c4637d2a4994d5d9cfc7
SSDEEP 24576:3hrv9c8r1x6kQL+wii11G6ThmKSxOe/6+rkseftppA9dNv:d9t1M+Li11RFZT+IftnAzx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/Dest.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dest.exe

File Explorer

ab94319787a2ae83dba8119d18363e43

.rar 1.2MB
Dest.exe

.exe 1.2MB
TZL.mb

164KB
新云软件.url

.url 133B

ab94319787a2ae83dba8119d18363e43

SHA256 ba094783ed8a2b979d7afd838b38d12022ebdb267e0cd14d392f5ddb70c458e3
MD5 ab94319787a2ae83dba8119d18363e43
SHA1 0c6e25d6fa97271e7a0fa92b57c81286db2dad86
SHA512 38ca4ba8e09a5cd397c615dddc3ee888223049c515cc368397d2fcc89912474748928fd13eb22d806151e7d136e3f5048e1eeb693681c4637d2a4994d5d9cfc7
SSDEEP 24576:3hrv9c8r1x6kQL+wii11G6ThmKSxOe/6+rkseftppA9dNv:d9t1M+Li11RFZT+IftnAzx
MD5 SHA1 SHA512 SSDEEP

Dest.exe

SHA256 3face5111da88662bbf39d366830a74fb1406459208d22d8732dfbcc2abfd8d9
MD5 2fe22482d210aada55369e3d89904c96
SHA1 d93594195a7745453fea545c8ebc4ee29eeb3391
SHA512 65249c168ddd69d7c50894f95ac86ffb36762c5ccee2345490a9929c10084658dfff7a3355aab049fad7ae493df90749b06f5a3a1602456fb09cbc5a8df7206c
SSDEEP 24576:O35czU2oem2xZsFoghCpL8fZylj+DO75TY+xepLa8LZ:Opc77sRol8RuCDO75TYUvc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4386817

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

1010KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

8KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

244KB

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sedwen

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

ab94319787a2ae83dba8119d18363e43

Dest.exe

generic

TZL.mb

新云软件.url