HorrorBob12[.]rar | Triage™

General

Target
HorrorBob12.rar
Size 14.3MB
Sample260529-ebxt7acv3x
SHA256 1d99e6a02a5928cc3d9acc072881a100be4f51c0605058e0bb859e1def804e0a
MD5 f080e835f08c95956284c126e99a76ee
SHA1 484a16e0b4f75cf980714c65e4997a532820097c
SHA512 0304f4a2feeab516457b3797986f84e2fcbb66e7577804e4bc9e0f4e796731ada910385fac1b03f06401e5b49da037814af19f64771e8e31c1107feef1f7b2b3
SSDEEP 393216:uZ8R7c5527SpRTXQYVlYEGnKKF6eeWg2AwhQ7hfiN2Bq1c0Ag2:uZ8JeE7SpRTAk8xxeWFAO+hfMor
TLSH
T1A5E633F9774C5800E320973160EC8A7E267CE87C29F598BD737C479BAA27F69D160A50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/HorrorBob2.exe	upx
static1/unpack001/horrorbob.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HorrorBob2.exe
unpack001/horrorbob.exe

File Explorer

HorrorBob12.rar

.rar 14.3MB
HorrorBob2.exe

.exe 11.9MB
horrorbob.exe

.exe 2.4MB

HorrorBob12.rar

SHA256 1d99e6a02a5928cc3d9acc072881a100be4f51c0605058e0bb859e1def804e0a
MD5 f080e835f08c95956284c126e99a76ee
SHA1 484a16e0b4f75cf980714c65e4997a532820097c
SHA512 0304f4a2feeab516457b3797986f84e2fcbb66e7577804e4bc9e0f4e796731ada910385fac1b03f06401e5b49da037814af19f64771e8e31c1107feef1f7b2b3
SSDEEP 393216:uZ8R7c5527SpRTXQYVlYEGnKKF6eeWg2AwhQ7hfiN2Bq1c0Ag2:uZ8JeE7SpRTAk8xxeWFAO+hfMor
TLSH
T1A5E633F9774C5800E320973160EC8A7E267CE87C29F598BD737C479BAA27F69D160A50
MD5 SHA1 SHA512 SSDEEP TLSH

HorrorBob2.exe

SHA256 98a804d373c7e0e4f80155df20358436e066ecf31c522c31df2ba46923ac68c2
MD5 9331b20120075b2685d3888c196f2e34
SHA1 1af7d3dc4576ef8aaa06fa3199cf422b7657950b
SHA512 83636067d46b1362a6e0e5af56222d170d337fa7b0c4048b8f04c9df0ca35c3634a7254e6226886b00f9894e4353d6ac6b2e4e760bab320058cebe37c7c0cd7b
SSDEEP 196608:zHvwfYWqhZPHE5D7cdPNPi17S+IRTX7UYVlj0EcLnKXanF6eeBUsjD2ABShiFiJt:vZ8R7c5527SpRTXQYVlYEGnKKF6eeWgO
TLSH
T1A2C633FDB1845810E1209B7120E5866B297CECFC55EAD8BD72240F9F7A67FD992B0720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15910592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

horrorbob.exe

SHA256 7122d3dbe8b1e3f2a0b8cacd38d013f756bb454b4af4eb360f6ffa4160e7b459
MD5 52989f91df34eb4fc6fa3f7c66323c64
SHA1 3f77fe2750aa288601af9fe8ce323530372ea97a
SHA512 8426b73f2b46fb3ae91efe93667e0841e2cb556f25bed2b555b45d2f03a0a844e7fa1a54e41223d89df26913d34b18831920c38ee8799767e8aeabb3dceed4fa
SSDEEP 49152:+S4TGw0jjZC7h9TTujZWq9F3xbCetyVZ4wJ7mzZhJN/:+S4TL0PA7vGfFELr7mVh7
TLSH
T101C533E56B4E9903FB185336F0EC896D9785A0193AF107ACB3BDC0A1D627B25D44EC87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26712528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

HorrorBob12.rar

HorrorBob2.exe

generic

horrorbob.exe

generic

Sharing

General

Malware Config

Signatures

File Explorer

HorrorBob12.rar

HorrorBob2.exe

generic

horrorbob.exe

generic