arkizz humbled twisted[.]exe

General

Target
arkizz humbled twisted.exe
Size 766KB
Sample260608-xtc7lse19k
SHA256 2250d9e426431acb4b19f374a8b1bca26666bd06f9f047251efdcc025872ba69
MD5 bb6292a97f38a5f88f1bf9b64f85f088
SHA1 c56645f8b6d609365bf1f0b300a8d2000ca53f56
SHA512 c5444fe35546b5bb12d524f6b06e1fa5753288a90f6b3ccd77e508baee353b2954158db041cd9733330b20b571d952eecc082588758d6a01c2ad2a818efbd3e2
SSDEEP 12288:6g19F7xh225gPIP+ckVfuLF19q99vnZTGN8GLNmdEGtVpDgiaLROn+uyZt0r5n5s:79F7PB5WImckVfaG9vnZilLN2j5DgiaL
TLSH
T1ADF4DFD92A624A9FC416733ECE25D6BA90D95BA4F243D392E470F015EE17B428F434E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
arkizz humbled twisted.exe
unpack001/out.upx

File Explorer

arkizz humbled twisted.exe

.exe 766KB
out.upx

.exe 1.4MB

arkizz humbled twisted.exe

SHA256 2250d9e426431acb4b19f374a8b1bca26666bd06f9f047251efdcc025872ba69
MD5 bb6292a97f38a5f88f1bf9b64f85f088
SHA1 c56645f8b6d609365bf1f0b300a8d2000ca53f56
SHA512 c5444fe35546b5bb12d524f6b06e1fa5753288a90f6b3ccd77e508baee353b2954158db041cd9733330b20b571d952eecc082588758d6a01c2ad2a818efbd3e2
SSDEEP 12288:6g19F7xh225gPIP+ckVfuLF19q99vnZTGN8GLNmdEGtVpDgiaLROn+uyZt0r5n5s:79F7PB5WImckVfaG9vnZilLN2j5DgiaL
TLSH
T1ADF4DFD92A624A9FC416733ECE25D6BA90D95BA4F243D392E470F015EE17B428F434E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

1544704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

out.upx

SHA256 660fc4518ebb5bde2b1dd54ddea28f76f7f65401d329e42638df8883a7d098e2
MD5 d70642b6205c35426b58f425373bf16e
SHA1 55648fd48d91c0c0e953f0f7132a3eee9473c883
SHA512 f5347f3169e2fa7b9bafb3168d90a6803ca21def5be31a4d1d003b880294a0f2f4089b89b04bf087a408b3b85c3989ace12f8283179fab8022d021176d3202a7
SSDEEP 24576:QUNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx72qDj5DgialO2:QUNxvC6FGYJf6yjNQpNONZnTX5PlGPgs
TLSH
T10F659E4633A2C0EACE67A3BACA25D233D2713410672A97DB54F0A91DDF53E914F32791
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

842544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

889KB

Virtual Size

888KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

279KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

arkizz humbled twisted.exe

generic

out.upx

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

arkizz humbled twisted.exe

generic

out.upx

generic