blackbird[.]exe | Triage™

General

Target
blackbird.exe
Size 610KB
Sample240318-sbv79aca7t
SHA256 1f75a4165bfd37b5c497d771ddc81c06daf4303f23973dd957ce3fcb52fd6966
MD5 6888e4803cdd4d904b23aaab78cbf8ce
SHA1 9b96b45a1cb0c828abb6c6018b851c9dab505132
SHA512 4331824c27149cb9bf859f132e9e231673c8af6a0b5a710e230f2cbe2359b3a0cd9217ff6e88bfdbcfa950ac3ad26ca9521656396a27a6a5edb75d10338128e6
SSDEEP 12288:yGmVTioZtOxl9vPlH1J8B3ljIRvx+hSFVcS5ZSUz+etipUg9VGvnz:xmiAoxlFN1J8B35MvIhSEmEUY9Vc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
blackbird.exe

SHA256 1f75a4165bfd37b5c497d771ddc81c06daf4303f23973dd957ce3fcb52fd6966
MD5 6888e4803cdd4d904b23aaab78cbf8ce
SHA1 9b96b45a1cb0c828abb6c6018b851c9dab505132
SHA512 4331824c27149cb9bf859f132e9e231673c8af6a0b5a710e230f2cbe2359b3a0cd9217ff6e88bfdbcfa950ac3ad26ca9521656396a27a6a5edb75d10338128e6
SSDEEP 12288:yGmVTioZtOxl9vPlH1J8B3ljIRvx+hSFVcS5ZSUz+etipUg9VGvnz:xmiAoxlFN1J8B35MvIhSEmEUY9Vc
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

714560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths