unfreez.zip
- SHA256 6b61293748a8500bf7dc073612715ee8d22dae38b0da25b7264a3007cacc209f
Behavioral task
behavioral1
Sample
UnFREEz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target unfreez.zip
- Size 19KB
- Sample260712-aje7wsdv7w
- SHA256 6b61293748a8500bf7dc073612715ee8d22dae38b0da25b7264a3007cacc209f
- MD5 9f691b203fd37254107b7b359df7d5b1
- SHA1 52cb8988815cec308a4b45fd7bcbf266fde0be38
- SHA512 07a3402eadd503a7afa70670e8c08b32b8a03fa8ea7113d0de86a5179caac098183d61b42dbc05d714c17bddeb3a5b01f4ee8a62040ac601a60bcba5e9afcb3f
- SSDEEP 384:L3ogKV4EogL4t3VLn99lB0lF2+yS/EqNbRqXpri+4Ef8PzeF6Yp+d5D4LFCOJQNm:7sSLnt7tS/E++pri+4zbDD4Dvb
- TLSH T15892D04B1936F8D673204C56581E93F122F9E8FB111C4B49DAD587CDC8C7CA749A52CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/UnFREEz.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/UnFREEz.exe unpack002/out.upx
File Explorer
-
unfreez.zip.zip 19KB
-
UnFREEz.exe.exe 27KB
-
out.upx.exe 56KB
UnFREEz.exe
- SHA256 5e43d6a019be6be6e79d15f101b3506b53e1c66995263abc23c31e6d4797cb44
- MD5 62afd8033decbdf21eaaf647ecbf487b
- SHA1 6e49621495cb06189ce1fd022640d5513f276f7f
- SHA512 67db85a4dac71be4244d86d871baf35b00bd1d221c880ff2eaca803aed5a7294a26b9353620ac3cc1c2f13fab269c353753240194c2db7341aa1b5f0d8ff241a
- SSDEEP 384:ud24pi1kgz9kVlUS7EHt3hHwNvRt+DF5Q6gmoG17iKDjRqrKDV5KDI1:ug4Xg6nUbHJcvRo/oG1NRTH
- TLSH T17DC27C9227605CC5E6C2AAF248478CB05258FD4744A03BBD66C13D2F5E3FE57DA0722A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, version=8047,
count=15, id=14, version=7299,
count=46, id=10, version=8047,
count=3, productName=Unmarked objects (old),
count=9, id=19, version=8034,
count=65, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 abf6d59b3597778e50f13d114d658fc82d8df1a0054d84a792c2164e829dfb54
- MD5 2a383cfff7196fd185ed4b9d994e8054
- SHA1 6b0296d7d7ccb9b19a3f174bc88778382e383bdb
- SHA512 6e72a0745861d9b5d33f4c1759211691fd551238a91f66832c20b6b1a3abd2b895a7630f624b8c1e077bf19f8091434d2b57dae16da141bf09785dcc9b28dff4
- SSDEEP 384:6/FGQOW3zTmoSYwbpe2OExjXCdF6MsYdZ7wL+qoyN0+hZxauKDjRqrKDV5KDI1nC:YeamoObY2xjSSpxqXIDWRTHB
- TLSH T1C1435E6369E04992D5D3D5F100A78E319B3FBE530551B9AB97C03D2E2D3AE92DD32312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8047,
count=15, id=14, version=7299,
count=46, id=10, version=8047,
count=3, productName=Unmarked objects (old),
count=9, id=19, version=8034,
count=65, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,