南岳传[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
南岳传.zip
Size 16.9MB
Sample260623-pc7e5acv8p
SHA256 c097478cde8e7da139aeeafe5236f828ac5d548f526d3f8f4b9ea835bc6e6d6d
MD5 f64e3c50d50f7436bb648477a025bce1
SHA1 195dcbbd1a1fa1de5db84400a424bacf94ecb77a
SHA512 1149984c1e46fdd6722f323712c78d9c59a25f708d4eccad76fd176c49e5b1eb4b5f3e9abd24ccc11b45b298a83477027f7699a393b16b560c0290ad274a52ca
SSDEEP 393216:y9RlFx+XJI4p5Y5Q9/1iWfbsIuq8sAK8kgHvyWrT+L:ARMXwmgIM1KcHaWrE
TLSH
T1310733B331E54C09E2CB6F988540C4A8917121A6B8996EE4F105FB7EA571370468FFFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/.exe

File Explorer

南岳传.zip

.zip 16.9MB
.exe

.exe 18.7MB

南岳传.zip

SHA256 c097478cde8e7da139aeeafe5236f828ac5d548f526d3f8f4b9ea835bc6e6d6d
MD5 f64e3c50d50f7436bb648477a025bce1
SHA1 195dcbbd1a1fa1de5db84400a424bacf94ecb77a
SHA512 1149984c1e46fdd6722f323712c78d9c59a25f708d4eccad76fd176c49e5b1eb4b5f3e9abd24ccc11b45b298a83477027f7699a393b16b560c0290ad274a52ca
SSDEEP 393216:y9RlFx+XJI4p5Y5Q9/1iWfbsIuq8sAK8kgHvyWrT+L:ARMXwmgIM1KcHaWrE
TLSH
T1310733B331E54C09E2CB6F988540C4A8917121A6B8996EE4F105FB7EA571370468FFFE
MD5 SHA1 SHA512 SSDEEP TLSH

.exe

SHA256 b349fac8cb7fcdd46e150af534d254a06c967dfd5c90770bd043e9f074d0be9c
MD5 6d512762a4d88eb064c5ea6922ef1c83
SHA1 c8a3fc033495d66a9eb47eeb6964e41ac213bf69
SHA512 08b93c814143a2f88bf45b1a61b5a963a36387b9e8a94cf13706cc5ee2fdbb2a47a96e05b2a5659d80f693abbf76c0fa1a804cf399135bf9315def04de0dd1e0
SSDEEP 393216:E4jtwfw7NKDzKibPhf0Rx09+7NNoULJmEeis20Y8eCzzsSfL6o:Er4kDmibPxlokEKVYyzoSf7
TLSH
T1D9172312BBE18476C5971A308D1B97F96279BF054E209C977BD07F0D6F31A81F2292CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1376892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

52B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.@"B

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

..K<

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.NewSec

Size

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

./L4

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

南岳传.zip

.exe

generic