Nursultan[.]exe | Triage™

General

Target
Nursultan.exe
Size 3.1MB
Sample260720-qs9e4aby6k
SHA256 fec6710eb73b05a91c509cedd12548961bc047d66dd290923393db66d25c684f
MD5 5077e162bf9381c24b9186f6f5706000
SHA1 e8a895f84f42e35f6f04a2c39a0c97ee92a465f4
SHA512 cc186275c230c0ef52a56915170f18031b9e29cfd4597c6f33702edd6e6dae475d5314ea8342dfb53ad043fce015fcc61e32a8dab71a3410867cbf8f69ca7c42
SSDEEP 49152:s99jwkvoqXd0vgZ9N/S99GLd1W8rILgSe0SDB9ppS9syRw7SSnX+OH374nugu+3t:yHvxXdqSlfULVzoWva2878ll08q+F
TLSH
T19CE533A811B97049CC6CBBBB799168DDE595F429E3388996E4FC481E1603DC03ED60FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nursultan.exe

SHA256 fec6710eb73b05a91c509cedd12548961bc047d66dd290923393db66d25c684f
MD5 5077e162bf9381c24b9186f6f5706000
SHA1 e8a895f84f42e35f6f04a2c39a0c97ee92a465f4
SHA512 cc186275c230c0ef52a56915170f18031b9e29cfd4597c6f33702edd6e6dae475d5314ea8342dfb53ad043fce015fcc61e32a8dab71a3410867cbf8f69ca7c42
SSDEEP 49152:s99jwkvoqXd0vgZ9N/S99GLd1W8rILgSe0SDB9ppS9syRw7SSnX+OH374nugu+3t:yHvxXdqSlfULVzoWva2878ll08q+F
TLSH
T19CE533A811B97049CC6CBBBB799168DDE595F429E3388996E4FC481E1603DC03ED60FE
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12104256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths