B4DA991E[.]zip | Triage™

General

Target
B4DA991E.zip
Size 189KB
Sample260726-2cca7sscng
SHA256 bdbd00daedaf1d831d905cac357ea83a2d3c028ec748e1dadd94ea4ddb2b838d
MD5 bdb7485c2819e68af384a5420bc44c74
SHA1 e3cc190a699695f2d3045e4d8bf47134937d4c63
SHA512 7e3402e0c75a6bd0c017557f9b7e675b1c8119840c975ec283a7e4ec6096185df087b48bcf8640fbb6a7a64f09653a1ec89aa5cf9fb16968f2614427816f4d8a
SSDEEP 3072:YLiH2/nEjAugVCAlrVnNql309cSNEdjigpB+ZrtlfscyXZfw+qPJXf8nZB:Yd/nEjAugnlRC2WiXpQtlwBJv8j
TLSH
T1A91423213B9B0ADCD594F43B86F373B59653CA1DE0273907A69758BC93BA1C3448B26C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/B4DA991E.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/B4DA991E.exe

File Explorer

B4DA991E.zip

.zip 189KB
B4DA991E.exe

.exe 678KB

B4DA991E.zip

SHA256 bdbd00daedaf1d831d905cac357ea83a2d3c028ec748e1dadd94ea4ddb2b838d
MD5 bdb7485c2819e68af384a5420bc44c74
SHA1 e3cc190a699695f2d3045e4d8bf47134937d4c63
SHA512 7e3402e0c75a6bd0c017557f9b7e675b1c8119840c975ec283a7e4ec6096185df087b48bcf8640fbb6a7a64f09653a1ec89aa5cf9fb16968f2614427816f4d8a
SSDEEP 3072:YLiH2/nEjAugVCAlrVnNql309cSNEdjigpB+ZrtlfscyXZfw+qPJXf8nZB:Yd/nEjAugnlRC2WiXpQtlwBJv8j
TLSH
T1A91423213B9B0ADCD594F43B86F373B59653CA1DE0273907A69758BC93BA1C3448B26C
MD5 SHA1 SHA512 SSDEEP TLSH

B4DA991E.exe

SHA256 0a97495da816f45f52236f2e32d4d179c98ee795092e08e79e6cb5611652779e
MD5 019fb1f4580ac71ec0483e1dcc10c808
SHA1 801ef53c736907202a1b051c5b858fbec3ba232c
SHA512 3632d04eff516b3ae3788bd17c52cba47c250c2114112ca3ce46071c787e0f90e2d574af59c0c5f3fa8070f0073e515d534148cde8577eef1d786c1a66fcd792
SSDEEP 3072:elkcaT2nEJAugVCwlrVnbql309cSNOdjimpB+ZjtNfscyvZfwaqPJXf69:gaT2nEJAugplR428i9dct9wdJv69
TLSH
T13DE4021322B173DCC84263B650F2F1B8A5DDAD396C13511767C27FEB76B61D24632A28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

689136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Resubmissions

Sharing