OpenArk64 (1)[.]exe

Resubmissions

09/07/2026, 12:56

260709-p6m9caay7r

18/04/2026, 09:17

260418-k89g5sbz6x8

Sharing

Copy URL Twitter E-mail

General

Target
OpenArk64 (1).exe
Size 11.9MB
Sample260709-p6m9caay7r
SHA256 97380a39c93c3cba7a0d970d736f47f66191904c3a1d90986d7b718097a39470
MD5 5aeacf915f0015648a397d2c1818304b
SHA1 4da1755b4585adf793b6df742c9d7460d8923bae
SHA512 1cc37c096d38053c9cd1f17764b7a94af871ab74f2a84bd3db173fd6c5cde09e73a228e85ef4a0f4f1841f22642860cf3d30d79aa339bcb78c3d98d12d6a5164
SSDEEP 196608:zbd3VKsHPYmsHsZvJ2WUtJma8GDkJKWKJVMeTGo2en759TIlNzSk3uMUSEharF3S:/DPYJH0xJUt4a84kJlKJVNTG4g7hlxtP
TLSH
T112C633A814364563FA255976A12078CA894E3C310787A6F68FDEFCD790FD8E0D681F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
OpenArk64 (1).exe
unpack001/out.upx

File Explorer

OpenArk64 (1).exe

.exe 11.9MB
out.upx

.exe 25.8MB

OpenArk64 (1).exe

SHA256 97380a39c93c3cba7a0d970d736f47f66191904c3a1d90986d7b718097a39470
MD5 5aeacf915f0015648a397d2c1818304b
SHA1 4da1755b4585adf793b6df742c9d7460d8923bae
SHA512 1cc37c096d38053c9cd1f17764b7a94af871ab74f2a84bd3db173fd6c5cde09e73a228e85ef4a0f4f1841f22642860cf3d30d79aa339bcb78c3d98d12d6a5164
SSDEEP 196608:zbd3VKsHPYmsHsZvJ2WUtJma8GDkJKWKJVMeTGo2en759TIlNzSk3uMUSEharF3S:/DPYJH0xJUt4a84kJlKJVNTG4g7hlxtP
TLSH
T112C633A814364563FA255976A12078CA894E3C310787A6F68FDEFCD790FD8E0D681F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27285648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=26, id=241, version=40116,

count=182, id=243, version=40116,

count=43, id=242, version=40116,

count=6, id=199, version=41118,

count=12, id=259, version=24237,

count=2, id=203, version=65501,

count=132, id=261, version=24237,

count=42, id=260, version=24237,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=135, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=709, id=1, productName=Unmarked objects,

count=116, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=800, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, id=260, version=24247,

count=220, id=261, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,

out.upx

SHA256 b115eec0c70b04f2b94b10147f5cbcb5e7dd4899114fb1e38575d7b99fe8a9f2
MD5 d3594240ce8fd6a38427f6cfe78e8e0b
SHA1 d1c3bd379adab29f17eb60071d88de3e0d4b936b
SHA512 8c429f16b594bee524edc6509217451449f4b2411ad108ffac3f2724e9b45b914240765722e543af945b8baca1209f3e1546816d334093ee3e3937b1e0351baa
SSDEEP 393216:ST6tEbdhxjx+Hp2TGfGC9kazXusB8XFYWQBsASt39WNKF5xJsv6tWKFdu9C8g1Ny:Su6F+HoXQBWt3LKg1A
TLSH
T122579C5B76A400A4C0BAC07DCAA38517FB71B4062B716AEF1265976E1F33BF05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13059708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

14.9MB

Virtual Size

14.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

300KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

776KB

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=26, id=241, version=40116,

count=182, id=243, version=40116,

count=43, id=242, version=40116,

count=6, id=199, version=41118,

count=12, id=259, version=24237,

count=2, id=203, version=65501,

count=132, id=261, version=24237,

count=42, id=260, version=24237,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=135, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=709, id=1, productName=Unmarked objects,

count=116, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=800, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, id=260, version=24247,

count=220, id=261, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,