Eduard Gomberg[.]zip

Resubmissions

22/08/2024, 06:35

240822-hcqn2stape7

22/08/2024, 06:34

22/08/2024, 06:29

22/08/2024, 06:01

21/08/2024, 08:35

21/08/2024, 08:30

Sharing

Copy URL Twitter E-mail

General

Target
Eduard Gomberg.zip
Size 1.4MB
Sample240821-kenctayemf
SHA256 7e4f19f682f2ea7ccb18aaf7e5d37141d2b849af2def68a7a22e4140298d98b7
MD5 d71e958a06b2b8c34114fa54bbd89d3c
SHA1 01c7d08bf249d02511af5b3c3c243fc319a80d65
SHA512 17071facfb366a8d135a0ac57bb41cb38b4c92ca20d07cc54783ab08712d11dc04c478cbf78d9b36d84350f8be65e74e3975c5f3d95c7b928d2457544c806619
SSDEEP 24576:PkBz8qC2oXT/ARBb6lJ1Np3pgC5XjbFDK0A7fupdv7o2EK9U6LFVma9J:MLC2ckML1Np3d5dK0RpSDAXz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/eduard_gomberg_cci_com_kz\Documents\Microsoft Teams Chat Files\Reader_Install_Setup.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eduard_gomberg_cci_com_kz\Documents\Microsoft Teams Chat Files\Reader_Install_Setup.exe
unpack002/out.upx

File Explorer

Eduard Gomberg.zip

.zip 1.4MB
eduard_gomberg_cci_com_kz\Documents\Microsoft Teams Chat Files\Reader_Install_Setup.exe

.exe 1.4MB
out.upx

.exe 4.1MB

Eduard Gomberg.zip

SHA256 7e4f19f682f2ea7ccb18aaf7e5d37141d2b849af2def68a7a22e4140298d98b7
MD5 d71e958a06b2b8c34114fa54bbd89d3c
SHA1 01c7d08bf249d02511af5b3c3c243fc319a80d65
SHA512 17071facfb366a8d135a0ac57bb41cb38b4c92ca20d07cc54783ab08712d11dc04c478cbf78d9b36d84350f8be65e74e3975c5f3d95c7b928d2457544c806619
SSDEEP 24576:PkBz8qC2oXT/ARBb6lJ1Np3pgC5XjbFDK0A7fupdv7o2EK9U6LFVma9J:MLC2ckML1Np3d5dK0RpSDAXz
MD5 SHA1 SHA512 SSDEEP

Password

infected

eduard_gomberg_cci_com_kz\Documents\Microsoft Teams Chat Files\Reader_Install_Setup.exe

SHA256 40cd26e07ea866a5919b2acaada28f37cad8ead917ba1116c64c0bc0271bef94
MD5 1fcea190ac157ba412937f6538db6edc
SHA1 cf338f8d4fddfccd16363f11a59c2c4ee02d6c3d
SHA512 0b65f9f608e2d89e9db0f3aeb16639decb2e50cb0a3b4184e03649e2381ed10bb9dcd9519af165e191fde94899abb16a4c63004300f1f976ddbb6190b393b721
SSDEEP 24576:d1DHT+hkM8gWHnO9TsHscBDuZnNtRiCx2VRPdV6Vpy0lMRk8T6VEiAB5QKuF:nKiMhBmrB6ZMCsVRPdV6V3l7Gv0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4480240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 f92d315464b38b2efdc989af15b2366a7150244765bd96c8ec914e278e0eda8d
MD5 5564f50c7af199309486b41324f9e2fc
SHA1 0506fb23caca272ef37c0486e454335478e5d6ef
SHA512 8ddfed489e96334f57c56e49ca2a9a0e3457a078eba359d0fdc213742d62680d9f01c4a2db82220d5d9c627851e56cec19b0a3d30d671d495dd877f1e7d3af54
SSDEEP 98304:mhfN/UjNEMjKF4KOP9w64MeC6T1WJuFRlrWHNFkeP9ISfh:mBmj84pw3CuFRl
MD5 SHA1 SHA512 SSDEEP