SRB2_v207_patch[.]zip

General

Target
SRB2_v207_patch.zip
Size 1.0MB
Sample240610-xgmkhswere
SHA256 cd259413d92c86e576523fc8f549e32f70110411c994440ba25415237db9a35b
MD5 97c0fa10fdc72759a275435a2d3745cc
SHA1 a484b371b3ffdac9e216b8c7f054048847c7ac3b
SHA512 be30cbc612a2da376e6e99f0ba7d692bded4ddd9c20325e9b082e369311aaec213005e8d157e366f701868ba632ff41130b5e9a2c7f4fcd082360e0b3bc287b2
SSDEEP 24576:2im1SnU94iFWipSt6kAZfgNhfRI9COTi8CO69/jokdNcG3GINsui:LnUvSuZfgD47oLok3c/IN9i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/srb2win.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/srb2win.exe
unpack002/out.upx

File Explorer

SRB2_v207_patch.zip

.zip 1.0MB
srb2win.exe

.exe 1.3MB
out.upx

.exe 2.0MB

SRB2_v207_patch.zip

SHA256 cd259413d92c86e576523fc8f549e32f70110411c994440ba25415237db9a35b
MD5 97c0fa10fdc72759a275435a2d3745cc
SHA1 a484b371b3ffdac9e216b8c7f054048847c7ac3b
SHA512 be30cbc612a2da376e6e99f0ba7d692bded4ddd9c20325e9b082e369311aaec213005e8d157e366f701868ba632ff41130b5e9a2c7f4fcd082360e0b3bc287b2
SSDEEP 24576:2im1SnU94iFWipSt6kAZfgNhfRI9COTi8CO69/jokdNcG3GINsui:LnUvSuZfgD47oLok3c/IN9i
MD5 SHA1 SHA512 SSDEEP

srb2win.exe

SHA256 945083469a67dcef068693fb1b745c2a71c5ae9fc859b2f24bf01c04ef91a044
MD5 78fe2fb65d4e11995a66533ff8f32392
SHA1 71c16e0473c0ca57973bc154c67f7a7f0049ecdf
SHA512 7a26d5ae08e46984c247dba6c5d02b3e7b4ba529bf352a36d5b6d8583ee40113812c4636cf16ccb77369b33ef81be63fa6a992677d74aea1dc3f75d3147f8435
SSDEEP 24576:GvdRIvKuvMq7u/RCPgswX/GNfVJGEp+qy4bicGXS3QafTGNUYOJwlCh/pxI:yqoq7oCfEu/psPafTUfOJwiBm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7064704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 8bbfb9b2f04031618f022499f0ed771e7fd55e9b9b900bb34659d0caf21e7723
MD5 d6215907f499229f26d83f386d1313c4
SHA1 b723bfe83efaca6906732d1706ada2ded47d9e50
SHA512 461f152b3b2242b2c12bc7f79d834933452cb250b614eb374030b23d6e3417cd3785eef036f3ae595919c6a8bf86652a33056cfe061705fa43254a786ef4aed3
SSDEEP 49152:7603H9VRev6IKIre66bWkeaPVjwcT1kCd1fiJfCT:7603H9veTKIrp6bWknPV8C/fi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

855KB

Virtual Size

854KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE

SRB2_v207_patch.zip

srb2win.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

SRB2_v207_patch.zip

srb2win.exe

generic

out.upx

generic