Nursultan client[.]zip

General

Target
Nursultan client.zip
Size 3.4MB
Sample260704-sdj8rsgy21
SHA256 c1226d734227e8e157a85431f00f2bbca1bd023bdbe3dce056eb1791348842c5
MD5 4f827bb1df2ed03e5dc0c7a0b7518236
SHA1 b4cf523757a3f650c85a560e3b52beb146320fd8
SHA512 640c719be468175f3d07a29a50279b8b8d8728668269b054ecc4aab944c69045d4a4d8895ae068190d37dbe91aff3be2378ad657717bf0af068107342f1bacbc
SSDEEP 98304:UtkUcBdrq/LZcoQKpU59P5Z6nUzs6M/OFJfVvnn:UtkFVq/LSg+7PKnjOFJdPn
TLSH
T1E5F53383C066F6F7C89234978D426BF518BBD0B33059923E4F5964FA2B42926DE47363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/Nursultan client.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nursultan client.exe

SHA256 c1226d734227e8e157a85431f00f2bbca1bd023bdbe3dce056eb1791348842c5
MD5 4f827bb1df2ed03e5dc0c7a0b7518236
SHA1 b4cf523757a3f650c85a560e3b52beb146320fd8
SHA512 640c719be468175f3d07a29a50279b8b8d8728668269b054ecc4aab944c69045d4a4d8895ae068190d37dbe91aff3be2378ad657717bf0af068107342f1bacbc
SSDEEP 98304:UtkUcBdrq/LZcoQKpU59P5Z6nUzs6M/OFJfVvnn:UtkFVq/LSg+7PKnjOFJdPn
TLSH
T1E5F53383C066F6F7C89234978D426BF518BBD0B33059923E4F5964FA2B42926DE47363
MD5 SHA1 SHA512 SSDEEP TLSH

SHA256 af10aa8041e0d632f0b5b4d2c2ab2815ec6294cc276d86a78708a6190826b28a
MD5 136497ddc82bd162235f93c66286f6f8
SHA1 49c2aece91f20d8471341a96a175d273a2859269
SHA512 ecd265ecbdc41c140c333707d774d5a31eb544be9820c8c67d9e81487cb4086c3db191e0e3f4410ef9d42eeff70af5835fb78715cab8f590c00b299664c0bc48
SSDEEP 98304:0vi6cdfXyPXP2eeIh2xBZJZozsx2i0d0FllVnT:0vivPyPXukADZozh0FlLT
TLSH
T183F53383C066E6B7C89234B3CD426BB518BBC1B33055923E4F5964FA2B53926DE47363
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12930960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths