b77596366a37bfc42c4c0f88bd78880f

Sharing

Copy URL Twitter E-mail

General

Target
b77596366a37bfc42c4c0f88bd78880f
Size 452KB
Sample240306-p8fx2sbc8x
SHA256 67c03aa495419221066bf68e9f27c124484c02e27e632080222f0d1d5fa54907
MD5 b77596366a37bfc42c4c0f88bd78880f
SHA1 e790bfb4209e679f7ca1a97f3655ed5a51bd6d8d
SHA512 e415891237fe2c4c7fa4da28a62b8c18531c3d2009f32b0388b7e8003c63dda1e9080b1313d0a16276c020f16b6d7a85cfc001e4dc30a8670276726cf1f0a05c
SSDEEP 12288:BuxDhM+CBzpxxO1eGk4zmEgahGyDCXSJVXG5:cV841eGkSiah1DCiJg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/断网关机 0.2/断网关机V0.2.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/断网关机 0.2/断网关机V0.2.exe

File Explorer

b77596366a37bfc42c4c0f88bd78880f

.rar 452KB
断网关机 0.2/断网关机V0.2.exe

.exe 467KB
断网关机 0.2/新云软件.url

.url 133B

b77596366a37bfc42c4c0f88bd78880f

SHA256 67c03aa495419221066bf68e9f27c124484c02e27e632080222f0d1d5fa54907
MD5 b77596366a37bfc42c4c0f88bd78880f
SHA1 e790bfb4209e679f7ca1a97f3655ed5a51bd6d8d
SHA512 e415891237fe2c4c7fa4da28a62b8c18531c3d2009f32b0388b7e8003c63dda1e9080b1313d0a16276c020f16b6d7a85cfc001e4dc30a8670276726cf1f0a05c
SSDEEP 12288:BuxDhM+CBzpxxO1eGk4zmEgahGyDCXSJVXG5:cV841eGkSiah1DCiJg
MD5 SHA1 SHA512 SSDEEP

断网关机 0.2/断网关机V0.2.exe

SHA256 6c81c4cc509b598ca1c7277a93404c01f78016bec0a49bdd648351401b4cbe52
MD5 6c3847d104bddaa4865a8bdd2282539c
SHA1 d9a956eadf66d64c4db337a2bee183872ec15dea
SHA512 9f3025132a476e18e1e49c4b664f2374217ca85f475ae603b1c80bde7d07b5dfeaeb8bc29a0406014c54606d9f2db8cd1cf379d26ed14c61620584ba18e55d90
SSDEEP 12288:sh3Fm0NIFZB+j4jSLn8FoXyVkWVPZtx5bqvm:sh3FmdZ8hz8F+YxVPHbqe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1363969

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

377KB

Virtual Size

968KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

8KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b77596366a37bfc42c4c0f88bd78880f

断网关机 0.2/断网关机V0.2.exe

generic

断网关机 0.2/新云软件.url