Antidote-[1[.]0[.]4] )[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Antidote-[1.0.4] ).zip
Size 10.6MB
Sample260629-15gkysgv21
SHA256 e63fa3be2f0c869fb53958372ebda14f37849c72dc0d4d7889c7a721544d7bc9
MD5 c456ec032a71b4edb0ccfc5ab40a36c3
SHA1 f66546935ddb73dadf6d5bb918759fffa447cc1a
SHA512 53e40f13e2e1c6102bcf73187c4f6899711ccc13201a1810ff80adbe3486a12d711ea2799da019b3987e4b4ceb8242d2c2565110007e8b0082387bcf245a3b1f
SSDEEP 196608:e1a5eU6nIQlxih/80NgadN4mJ6fDRLj/UQ3SrzA32niGqteYi3Sv8JSXFy5I8ddJ:/R4LlMU0CadN4mQdLj/U8aGGFG0JEp85
TLSH
T18CB633C16514649D9E1E25ACA29E0D000C3E90F6FAFE1CE872DA3F44E508B551FDAFB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx costura packer

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Antidote Spoofer.exe	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
static1/unpack001/Antidote Spoofer.exe	costura

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Antidote Spoofer.exe

File Explorer

Antidote-[1.0.4] ).zip

.zip 10.6MB
Antidote Spoofer.exe

.exe 14.2MB

Antidote-[1.0.4] ).zip

SHA256 e63fa3be2f0c869fb53958372ebda14f37849c72dc0d4d7889c7a721544d7bc9
MD5 c456ec032a71b4edb0ccfc5ab40a36c3
SHA1 f66546935ddb73dadf6d5bb918759fffa447cc1a
SHA512 53e40f13e2e1c6102bcf73187c4f6899711ccc13201a1810ff80adbe3486a12d711ea2799da019b3987e4b4ceb8242d2c2565110007e8b0082387bcf245a3b1f
SSDEEP 196608:e1a5eU6nIQlxih/80NgadN4mJ6fDRLj/UQ3SrzA32niGqteYi3Sv8JSXFy5I8ddJ:/R4LlMU0CadN4mQdLj/U8aGGFG0JEp85
TLSH
T18CB633C16514649D9E1E25ACA29E0D000C3E90F6FAFE1CE872DA3F44E508B551FDAFB6
MD5 SHA1 SHA512 SSDEEP TLSH

Antidote Spoofer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 02917c98b39013d382b72781b144759570294bb42e68fc4397f5396011b9185c
MD5 f2decc9a52f52906421528a676a271ea
SHA1 e07ea39a086e60f363ab99dc177b4ed228930f98
SHA512 d4d7235023445a835d0259cb0ef0c72f2fe353126f6dfb659012003d2432c7f5b8035e97a355e99852a86a9c11c0ecd8d68c727ed82fe798b5be9f3f2ede5287
SSDEEP 196608:+zNaMd9prgWmU15oZeEEsBGsmcZ9kaXw2o0wuM1uTSKUgOhE0u8nLZL8pokSI+2:mNaMdfgWbzABG+Q6w2Bk+rnYLZL9kSB2
TLSH
T1F6E6B74070FE98A1D42953FF1F00186D657FA0F40BDA32EBB49785472976E9A0A736EC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14868490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

,(up~4

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Enigma

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Femboy h

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UPX

Size

512B

Virtual Size

139B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Antidote-[1.0.4] ).zip

Antidote Spoofer.exe

mscoree

dotnet