HEUR-Trojan[.]Win32[.]ShipUp[.]gen-85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95

Sharing

Copy URL Twitter E-mail

General

Target
HEUR-Trojan.Win32.ShipUp.gen-85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95
Size 156KB
Sample240229-kds7nsbf98
SHA256 85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95
MD5 11c617a04d32dcb9ff7cea9b4dfd7b60
SHA1 dd7751b873e88d228319b7b4c75cc2f6ca025921
SHA512 b265574274ea51a8ced06529ec9a59db9443304db49ff3e2c2a7e5a97d78380b0772f917dd11d9dfc14e4e39bc9116cd6331fe8eac3841a24f9870f45a65196e
SSDEEP 3072:xYvIysz15AQnAsxKv6Notd4iOGp1Yh7d+EQvC6rP5/7XVvpEkNHh0LNtdoBqHgUV:2nsz15AQxKiNotd4LGp2hh+Jrrh/7xO3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aspackv2

Malware Config

Signatures

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HEUR-Trojan.Win32.ShipUp.gen-85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95

File Explorer

HEUR-Trojan.Win32.ShipUp.gen-85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95

.exe 156KB

HEUR-Trojan.Win32.ShipUp.gen-85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95

SHA256 85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95
MD5 11c617a04d32dcb9ff7cea9b4dfd7b60
SHA1 dd7751b873e88d228319b7b4c75cc2f6ca025921
SHA512 b265574274ea51a8ced06529ec9a59db9443304db49ff3e2c2a7e5a97d78380b0772f917dd11d9dfc14e4e39bc9116cd6331fe8eac3841a24f9870f45a65196e
SSDEEP 3072:xYvIysz15AQnAsxKv6Notd4iOGp1Yh7d+EQvC6rP5/7XVvpEkNHh0LNtdoBqHgUV:2nsz15AQxKiNotd4LGp2hh+Jrrh/7xO3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables packed with ASPack
ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

372737

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

144KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata2

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

HEUR-Trojan.Win32.ShipUp.gen-85c3c4e24ebc912bbcb82bb9f888e0e021552db3933bb32baeed35e563984d95

generic