hamsterball[.]exe | Triage™

General

Target
hamsterball.exe
Size 615KB
Sample260708-zygrpshs7m
SHA256 f1199122e65c954da81dd61212ed0c8eea914fdc04a600df2a100f8cff189eb6
MD5 369b2dea8a931851e26e1ffe2c090bf6
SHA1 a0964f08895a66ec18cac13f2f2d6eeeef005296
SHA512 4cf4df3df144a55afe66f9a28402c1feb169133029cd759fd898b81bdb39e6109fbd6c07bd191f7de9db9250552afc1666e5a7520ca59318e446941baf8c2068
SSDEEP 12288:v1ZplfroGRfjt5ztvWbGolpbzCseCdpe2Vrlesxcxg:dZzDowBD+ioltLHdg2llPe
TLSH
T1E1D423E0564090C8F750763703D7C00E62B3ADEA857B8EBBD3860EBE6735176A5BC856
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hamsterball.exe

File Explorer

hamsterball.exe

.exe 615KB

hamsterball.exe

SHA256 f1199122e65c954da81dd61212ed0c8eea914fdc04a600df2a100f8cff189eb6
MD5 369b2dea8a931851e26e1ffe2c090bf6
SHA1 a0964f08895a66ec18cac13f2f2d6eeeef005296
SHA512 4cf4df3df144a55afe66f9a28402c1feb169133029cd759fd898b81bdb39e6109fbd6c07bd191f7de9db9250552afc1666e5a7520ca59318e446941baf8c2068
SSDEEP 12288:v1ZplfroGRfjt5ztvWbGolpbzCseCdpe2Vrlesxcxg:dZzDowBD+ioltLHdg2llPe
TLSH
T1E1D423E0564090C8F750763703D7C00E62B3ADEA857B8EBBD3860EBE6735176A5BC856
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1712129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

346KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

77KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

21KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

158KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

10KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=14, id=29, version=9955,

count=12, id=39, version=9162,

count=49, id=64, version=9955,

count=156, id=28, version=9955,

count=4, id=29, productName=VS2002 (.NET) build 9466, version=9466,

count=2, id=19, version=8034,

count=13, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=8, productName=Unmarked objects (old),

count=1, id=18, version=8444,

count=80, id=29, version=9178,

count=2, id=28, version=8830,

count=3, id=37, version=8755,

count=3, id=19, version=9049,

count=1, id=29, version=8830,

count=3, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=28, version=9178,

count=15, id=25, version=9210,

count=202, id=1, productName=Unmarked objects,

count=93, id=43, version=9955,

count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=61, version=9955,

Sharing

General

Malware Config

Signatures

File Explorer

hamsterball.exe

generic