f3544211710d293dfe623411feb7e121f5a8b2ea8b9e5e545d1f51b1aa9aabe3
- SHA256 f3544211710d293dfe623411feb7e121f5a8b2ea8b9e5e545d1f51b1aa9aabe3
Overview
overview
10Static
static
7WezoAutoUP.exe
windows7-x64
7WezoAutoUP.exe
windows10-2004-x64
7culclientUp.exe
windows7-x64
7culclientUp.exe
windows10-2004-x64
7software.exe
windows7-x64
10software.exe
windows10-2004-x64
10vncDbnt.exe
windows7-x64
8vncDbnt.exe
windows10-2004-x64
8wzoptup.exe
windows7-x64
7wzoptup.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
WezoAutoUP.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
WezoAutoUP.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
culclientUp.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
culclientUp.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
software.exe
Resource
win7-20240705-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral6
Sample
software.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral7
Sample
vncDbnt.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
vncDbnt.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
wzoptup.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
wzoptup.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target f3544211710d293dfe623411feb7e121f5a8b2ea8b9e5e545d1f51b1aa9aabe3
- Size 4.2MB
- Sample240706-bajdma1bpm
- SHA256 f3544211710d293dfe623411feb7e121f5a8b2ea8b9e5e545d1f51b1aa9aabe3
- MD5 b9c98b028ee3a0ece95c0de562950397
- SHA1 b01ba75e6e1c3e4f4c9bf4d3df58b1a342448a6a
- SHA512 08d1487cad27f64ec0829b3175a0c41f896ff8cfb331de3db671810c371309c05426ea8d3b892235dc1b8a6e82c95dfbed1c079cfe84e63a3a1a5992c10befb2
- SSDEEP 98304:2xPJJVzsnf1ozRfFzsa5a7LhDfO7F9wf1/xP8OvO8LH+u:25anivs/LBO7EV5Hiu
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/WezoAutoUP.exe upx static1/unpack001/culclientUp.exe upx static1/unpack001/vncDbnt.exe upx static1/unpack001/wzoptup.exe upx - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe static1/unpack003/out.upx autoit_exe static1/unpack004/out.upx autoit_exe static1/unpack005/out.upx autoit_exe - Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/WezoAutoUP.exe unpack002/out.upx unpack001/culclientUp.exe unpack003/out.upx unpack001/vncDbnt.exe unpack004/out.upx unpack001/wzoptup.exe unpack005/out.upx
File Explorer
-
f3544211710d293dfe623411feb7e121f5a8b2ea8b9e5e545d1f51b1aa9aabe3.zip 4.2MB
-
WezoAutoUP.exe.exe 332KB
-
out.upx.exe 694KB
-
__MACOSX/._WezoAutoUP.exe229B
-
__MACOSX/._culclientUp.exe229B
-
__MACOSX/._software.exe229B
-
__MACOSX/._vncDbnt.exe229B
-
__MACOSX/._wzoptup.exe229B
-
culclientUp.exe.exe 329KB
-
out.upx.exe 694KB
-
software.exe.exe 5.5MB
-
vncDbnt.exe.exe 329KB
-
out.upx.exe 694KB
-
wzoptup.exe.exe 330KB
-
out.upx.exe 694KB
WezoAutoUP.exe
- SHA256 82a9537d99a9ccc5c534dd87f642a7e77b594f7554c2ed7a32a1a9518634a42c
- MD5 46748aff6fcab034d0affddc99c6d876
- SHA1 b9374a9f4b85ebf36218860f3f80da69505194db
- SHA512 8e91545dd88d436abf6afe3245c18254d38cbf994ef2226798544b48ed047e060b466d8ef06e7514cda50d367999a350b9695890510607d327c7bc9390ddf3d5
- SSDEEP 6144:m68oipnnK9jqXEX52Ums+Tbxzbx9SmIqQyPodMUf8Dkzel6R8zHe1IH:WfnnK9zABs+TbFx9SXOPCf8DkqAR8zHB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 b7b3a3b9208d2c0e7f823fb8e24b0fec267ea6eb8517b46ed16cef96d67a7fd0
- MD5 c02962465d3e71b383fc5866bbe0e86d
- SHA1 61cdefb20ed1c781f41a2ee14fce67c0217af618
- SHA512 5efc8c151880bb531ea89c81860fd0b911f019eaa8d1a3efd858c4b953ab6cdecb32ece123872c26062a5aea9c1d3b5265bbd45dbf28d7152e38446891bad290
- SSDEEP 12288:ai+ETezCHQkZPhprhmH6ukWAljnQlnl2OdpbxZymR:aiQsFhBhmAWAdnQxlfjx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
95520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
__MACOSX/._WezoAutoUP.exe
- SHA256 807c07a33aeffff3e40deb00d73a8da3043961a32bf723ece2cd5601887cf74f
- MD5 046634c80c29e646a4e94f4ec78a0cb5
- SHA1 57a2d9a938bf0007d0b356dc60f45a0d0cd07c2b
- SHA512 da8ec34fb82664d056e7155c51c73eb070d90c5acdb7c7e8df17509ef6e297f87b1d28ba4650d9acbdf6a64f35ffcc880d3483646fe172e6be0690a9552d0e7f
- MD5 SHA1 SHA512
__MACOSX/._culclientUp.exe
- SHA256 88cf1dc6eb1c8e8d080b53fa0e9fec96644391f36729445475d60b2c2dfc96d8
- MD5 affa9b3fe4d7d37bb658f09248a81aaf
- SHA1 777fe38c489b5b1f8e9f87d19959fbd367d3ff31
- SHA512 bf985f9c9d311abb2fb3a53955bd6888e963c0858f5eb71791065c8104628ebea22461c85de9eac80ae7b61bcadf1d4938a48d6af58d022f909d1fd33030606e
- MD5 SHA1 SHA512
__MACOSX/._software.exe
- SHA256 1971ed1618dfc96605231ae9185267e2c8242295f376985f9f5ba332af50be81
- MD5 a572aa2852cb4f6f7038be7b97c5d69e
- SHA1 953281e50d03bd56d10badcfb4bd953e1ab91b80
- SHA512 0c0512f310d9f63160cde071a5d99f3b70d1f9c1d2ee0b26d8d2f4f012f5560f4c9985dab426463ad1482e63f9a06a826ce8682730c33e0d20bee8ce6c8fab2c
- MD5 SHA1 SHA512
__MACOSX/._vncDbnt.exe
- SHA256 7ebfb915d7e49a2e3b9b4d76ca3af8c77c0e9167036e687e517cdf4332975297
- MD5 311600fa5a0aeedf51d40111817887f6
- SHA1 44d52a96b348909002e4713486c8ebfb5c4d544c
- SHA512 d51f0d2f627e3dd71bda2351a7dda8ac25642ea4b3f91af168a83d8e5945e519b5ebc2fd1fa5f744ce8d12f4a09ce8a44aac5d38418225e54d60d10240003c5f
- MD5 SHA1 SHA512
__MACOSX/._wzoptup.exe
- SHA256 fb4b0bfa1d1787efb8659d3960922eea642c563a773a69a3c1ddde719073e123
- MD5 13bc31cefe88d00d255e7f356c09eaa8
- SHA1 d9c1a79a0661d6abb998464f20f56c6353fbe56b
- SHA512 f3eec19b91771694a75a26b9af6c6292f398aca10e24275f80915b3a2aeab6ac74217388cd95a79721d314b832efcfbfa16d6d93a47b8ec011647a5a4f752334
- MD5 SHA1 SHA512
culclientUp.exe
- SHA256 f6c833657a31e9f8fc136f74aa251d428a6d2ee7bcc6fb74c00ba4f44e902edd
- MD5 915b7366ba2e87a3f5a6810903cbc38a
- SHA1 0d8fe32290ad5294cc6770daf316114e8cbcc60f
- SHA512 a6981d6a94ada77245eaeefdb577055e36f1465d400bbcbae064723dd3a3e7f37495926d45a4227e31631b87b513446901e7e48fa75a97823ff1eef681b7ce08
- SSDEEP 6144:u68oipnnK9jqXEX52Ums+Tbxzbx9SmIqQyPodMUf8Dkzel6R8zHe1IBG:OfnnK9zABs+TbFx9SXOPCf8DkqAR8zHu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 b7b3a3b9208d2c0e7f823fb8e24b0fec267ea6eb8517b46ed16cef96d67a7fd0
- MD5 c02962465d3e71b383fc5866bbe0e86d
- SHA1 61cdefb20ed1c781f41a2ee14fce67c0217af618
- SHA512 5efc8c151880bb531ea89c81860fd0b911f019eaa8d1a3efd858c4b953ab6cdecb32ece123872c26062a5aea9c1d3b5265bbd45dbf28d7152e38446891bad290
- SSDEEP 12288:ai+ETezCHQkZPhprhmH6ukWAljnQlnl2OdpbxZymR:aiQsFhBhmAWAdnQxlfjx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
95520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
software.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 83b2f6c63dc3ec6cea64755ce2042ff747d52571daaef8a47934e00378f0afd3
- MD5 1ed6f9d578e14edad0bf47edf1f6269f
- SHA1 0e6546d7a7f237a4c094e24810fd4ab29ab6a970
- SHA512 7481e391bc9fd0b0a30ca7464847e6ab0bbaa4febb8bfb33407742fd2e90f7fb0d88fd2ab0dc49fa499864e16a234d6f910926944c2a3ce337d614351dccfd60
- SSDEEP 98304:zeL9fRCBL/JS6w1PMcf5blPwJp003KOIupEAjlgJHc6:zeL9ROL/Eh/PQbaObEACl
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
47:cb:7e:cc:7a:52:8c:a6:91:f4:cb:4f:5f:c3:54:0a:fb:46:b0:14:85:aa:38:8e:79:2b:6d:b9:8e:c5:84:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=[̲̅M][̲̅a][̲̅r][̲̅i][̲̅a][̲̅ ][̲̅c][̲̅o][̲̅r][̲̅p][̲̅o][̲̅r][̲̅a][̲̅t][̲̅i][̲̅o][̲̅n][̲̅ ][̲̅i][̲̅n][̲̅ ][̲̅b][̲̅a][̲̅n][̲̅g][̲̅k][̲̅o][̲̅k]
Chains
Jul 4, 2024
Subject
CN=[̲̅M][̲̅a][̲̅r][̲̅i][̲̅a][̲̅ ][̲̅c][̲̅o][̲̅r][̲̅p][̲̅o][̲̅r][̲̅a][̲̅t][̲̅i][̲̅o][̲̅n][̲̅ ][̲̅i][̲̅n][̲̅ ][̲̅b][̲̅a][̲̅n][̲̅g][̲̅k][̲̅o][̲̅k]
Serial Number
6a:6a:a4:4c:32:10:15:a2:47:5e:ae:5b:96:91:56:9b
Issuer
CN=[̲̅M][̲̅a][̲̅r][̲̅i][̲̅a][̲̅ ][̲̅c][̲̅o][̲̅r][̲̅p][̲̅o][̲̅r][̲̅a][̲̅t][̲̅i][̲̅o][̲̅n][̲̅ ][̲̅i][̲̅n][̲̅ ][̲̅b][̲̅a][̲̅n][̲̅g][̲̅k][̲̅o][̲̅k]
Timespan
Jun 24, 2024 - Jun 25, 2034
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
5593758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
softwarejapan.pdb
mscoree
_CorExeMain
Name
.text
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
vncDbnt.exe
- SHA256 acd89e772ca1bc9d3c69cff7430fa4bb921d4468d6115c57cade092944572eb3
- MD5 3597cd93701c4505d035a34271e0b931
- SHA1 63b311fd5f0d98166273e22ca8fb16c219d3ba07
- SHA512 32175d64523038c480a21f609a036c1ed206a1b45eb986da6d20b8e2e1924aefe1eb93d66c1bcd03334e8c126df40d272f0e4e02397ed16db167d3994738a6a3
- SSDEEP 6144:J68oipnnK9jqXEX52Ums+Tbxzbx9SmIqQyPodMUf8Dkzel6R8zHe1IX:ffnnK9zABs+TbFx9SXOPCf8DkqAR8zHN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 b7b3a3b9208d2c0e7f823fb8e24b0fec267ea6eb8517b46ed16cef96d67a7fd0
- MD5 c02962465d3e71b383fc5866bbe0e86d
- SHA1 61cdefb20ed1c781f41a2ee14fce67c0217af618
- SHA512 5efc8c151880bb531ea89c81860fd0b911f019eaa8d1a3efd858c4b953ab6cdecb32ece123872c26062a5aea9c1d3b5265bbd45dbf28d7152e38446891bad290
- SSDEEP 12288:ai+ETezCHQkZPhprhmH6ukWAljnQlnl2OdpbxZymR:aiQsFhBhmAWAdnQxlfjx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
95520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
wzoptup.exe
- SHA256 7a3271b0079e9f56f20acdb731e46174fc0a1f1a59e5fbd951a6ce9c07db48f9
- MD5 206c606e09f81262fbc85065ceca4f59
- SHA1 96fa2aba33f86d809697d04d083ef3f6108ab197
- SHA512 57b0fe98b3da4193c6ea267c4be05c5f3a6d2a24f2e79a4cf98d6a3e68e03f1bf9a7438f7f90bb2b6eb11a59ff4e81c5422538f20abf69b4feb4107be900f5e0
- SSDEEP 6144:e68oipnnK9jqXEX52Ums+Tbxzbx9SmIqQyPodMUf8Dkzel6R8zHe1I3A:efnnK9zABs+TbFx9SXOPCf8DkqAR8zHK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 b7b3a3b9208d2c0e7f823fb8e24b0fec267ea6eb8517b46ed16cef96d67a7fd0
- MD5 c02962465d3e71b383fc5866bbe0e86d
- SHA1 61cdefb20ed1c781f41a2ee14fce67c0217af618
- SHA512 5efc8c151880bb531ea89c81860fd0b911f019eaa8d1a3efd858c4b953ab6cdecb32ece123872c26062a5aea9c1d3b5265bbd45dbf28d7152e38446891bad290
- SSDEEP 12288:ai+ETezCHQkZPhprhmH6ukWAljnQlnl2OdpbxZymR:aiQsFhBhmAWAdnQxlfjx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
95520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,