bafca5fedc598339040c9015e62eaa59

Sharing

Copy URL Twitter E-mail

General

Target
bafca5fedc598339040c9015e62eaa59
Size 284KB
Sample240308-l5f7vscd28
SHA256 bc218de9ed95bc191cf408d7a522216edb0e6c1c1508d8eef7f3b86700b8ac43
MD5 bafca5fedc598339040c9015e62eaa59
SHA1 99c6a8f9992a02e2c80ed450c924eae42fa1b614
SHA512 5948d720d4833647973ef11733dae64366ae2b093cf2a48fe0277c23bce510fde53b978a5feabc7f24a2284d40236830d4ae330db1882bb15e650f529ff5ad3b
SSDEEP 6144:0RZrj+8WUC0fOvC85+HWxl0sUuUFtjkLyeOCSgqjbCud76AukhYO:0RZ/cUFOfoHWx1MFN4y7pbp96MhYO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/股市小算盘.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/股市小算盘.exe

File Explorer

bafca5fedc598339040c9015e62eaa59

.rar 284KB
新云软件.url

.url 133B
股市小算盘.exe

.exe 290KB

bafca5fedc598339040c9015e62eaa59

SHA256 bc218de9ed95bc191cf408d7a522216edb0e6c1c1508d8eef7f3b86700b8ac43
MD5 bafca5fedc598339040c9015e62eaa59
SHA1 99c6a8f9992a02e2c80ed450c924eae42fa1b614
SHA512 5948d720d4833647973ef11733dae64366ae2b093cf2a48fe0277c23bce510fde53b978a5feabc7f24a2284d40236830d4ae330db1882bb15e650f529ff5ad3b
SSDEEP 6144:0RZrj+8WUC0fOvC85+HWxl0sUuUFtjkLyeOCSgqjbCud76AukhYO:0RZ/cUFOfoHWx1MFN4y7pbp96MhYO
MD5 SHA1 SHA512 SSDEEP

股市小算盘.exe

SHA256 963c7497cf3abb4e615df167b8e2c47d52b115514b69a4ab3782377e02dda926
MD5 72aca8290de0a89446b2eac755d58f5c
SHA1 291fdc75359472993ac5e01d03a35fb9463928ac
SHA512 f2a38952e4bf750edc64ce323b6f402b9ac01075be1e3a32e2862e80b6ef99d2c1a190693a80f3ded13b627dee4eae8c49fcd3d3bc88f85bd7962fffe662beff
SSDEEP 6144:RW1snn5JxlHVyPE6OY5m7LLXjaHKJ+z40rRNvll3oXmuukQ:4qnxlHoE6R5OLbOzxjvxHk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

925697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

242KB

Virtual Size

648KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

14KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

bafca5fedc598339040c9015e62eaa59

新云软件.url

股市小算盘.exe

generic