7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c

General

Target
7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c
Size 253KB
Sample260710-v2ghwsdv7k
SHA256 7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c
MD5 144f573b7670e5a1e6983c6f98a93428
SHA1 b05482a95320237bdf80bf6bacd8bc90129eac82
SHA512 78cd35e5ce0af5b7ac97c494fe69f400023aa22c2079c7e30a7f7838484ec5a63c404ef6429b6c45b562ef0d08f9f12856c670267fe362d428820ac2aa3e0659
SSDEEP 6144:fKL/EpGLlTQHebSkmRvr/VOX1zTmalRvNksxH6eHrN4nA:fKL8ERTQHebSkEvr9OFvmalRvNdxSnA
TLSH
T1914423964C98D95F2094C3D79EB2639326BE4E0B23034B1BDA3F65E324CA15E40629FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/红枫叶客户端 V3.1.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/红枫叶客户端 V3.1.exe
unpack002/out.upx

File Explorer

7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c

.zip 253KB
红枫叶客户端 V3.1.exe

.exe 263KB
out.upx

.exe 200KB

7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c

SHA256 7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c
MD5 144f573b7670e5a1e6983c6f98a93428
SHA1 b05482a95320237bdf80bf6bacd8bc90129eac82
SHA512 78cd35e5ce0af5b7ac97c494fe69f400023aa22c2079c7e30a7f7838484ec5a63c404ef6429b6c45b562ef0d08f9f12856c670267fe362d428820ac2aa3e0659
SSDEEP 6144:fKL/EpGLlTQHebSkmRvr/VOX1zTmalRvNksxH6eHrN4nA:fKL8ERTQHebSkEvr9OFvmalRvNdxSnA
TLSH
T1914423964C98D95F2094C3D79EB2639326BE4E0B23034B1BDA3F65E324CA15E40629FD
MD5 SHA1 SHA512 SSDEEP TLSH

红枫叶客户端 V3.1.exe

SHA256 69d2c150f0ef77d79f14d0c4e3cc0aa68619aa13b767210afa2d5a4745969783
MD5 a0375bd6d63ececefdaa3974ff92ca9e
SHA1 ee6b35f746072104a44f25163c146824396acf5e
SHA512 f785548ebd036410571bc140e99c894f459c7a95294e3b279bc26a584519aee977bf9e915848de431ee5bc4d6623409a131ba50b2fa657c2df9192062faa232f
SSDEEP 6144:s6AaKWNMSFZwAelSk4RvrTVuZ1z5mW3RvN6OxHAeHr2Twu:X5KwHwAelSk+vrxundmW3RvNLxYT/
TLSH
T1D7441245B910DB1EF09491BBCFF8D7F7049D8E146B170B13A9693F83387A11A994A0B9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

223200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 ac7afe2cb887a65d43c5a641190515e75289283a9539743545937e44dc634820
MD5 2daeb6ac1643a5ba8f3625605aa8c129
SHA1 7805333c474858c077502c87795e4f3b3754d143
SHA512 bf37cb5c2de9360b0b9ac260d3dcf0566b0d3a5493a6534fa3962755c508b5ee9694194cba78e41eaf93a90928329681bb005cbfe34cc84a67e19c5c50cb91f9
SSDEEP 6144:9YsrnLiDDKTs4l9J2Tx/HQNR6MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMML:WsrnQKTs4il
TLSH
T156145C5076D0C47ED5622C389BDDC6F0EB66DEF40A069B33B389BB133A748A1790621D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

76434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c

红枫叶客户端 V3.1.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

7813b7a31ac9f251e26156496d61c44b4b14aff5390b8212b050033975395d7c

红枫叶客户端 V3.1.exe

generic

out.upx

generic