Wormhole 70yPKW.zip
- SHA256 3f5ee1642489993cb01bf5fd976232af7cb5ffe0048950b4d8dfbc185b2d52f0
General
- Target Wormhole 70yPKW.zip
- Size 3.4MB
- Sample260726-zhdp4s1eme
- SHA256 3f5ee1642489993cb01bf5fd976232af7cb5ffe0048950b4d8dfbc185b2d52f0
- MD5 e47a98b3bb5d964ac2bc3200e160def0
- SHA1 4040845d5a16897c1d2e5c96055968b60b3ae920
- SHA512 b0ccd66a744f09d92b519d7720aecc9f321f46cfa1114ae98281362657188287cb3b958b4e9e90e3566a0ac6a4cdf7a65e996807a4c76f480d3234bc648b91f4
- SSDEEP 98304:kQfpErvE+A1kvgp6hfNiE0C7wfhbDdCpD:pxErsr1k4p6hWOw5X4pD
- TLSH T18CF53332C1E4C55FD7A4C8FA93727F6E8A02444D76C2029964797BCA9FCB4F92E42853
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/spoolsv.exe.bak upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/spoolsv.exe.bak
File Explorer
-
Wormhole 70yPKW.zip.zip 3.4MB
-
SquirrelSetup.log12KB
-
spoolsv.exe.bak.exe 3.4MB
SquirrelSetup.log
- SHA256 16cac3e7c1afe6abb80d37fac92f1ba96a79051a8a5f16996409572b758c3cc0
- MD5 009a80ccea6e5c2792910ef49606ba99
- SHA1 35b334f8626634ddf479a6f2dad45cd3b81d76c9
- SHA512 b3e63d70965308aaf5adc5d6bfdff52eef3f7ddd8f7df91d93b6d7c7a871677cd2ccda82bf98a9a21e413dcbeec6e04eae3f79fb7122600aa5cfa84084334ac1
- SSDEEP 96:9GphadAMABa2Qf/rFEVCmUZD+D+KHKDZPloVGFEVCmUZD+TZ:9GphadAMABPO/rCsJKHKDZ9oVGCso
- TLSH T1F442BC038BF3D83E254601EF9FA9E72A4B96658C3B466BE823A1444C5FC241D6FE6D50
- MD5 SHA1 SHA512 SSDEEP TLSH
spoolsv.exe.bak
- SHA256 b57f6c4e098dc2cc6d3e72f54772a18c42b9e1da3fcb1782a2a8137063d13c77
- MD5 58b15fedc5db97b89b102eb8cff2ac97
- SHA1 3822bee4e194f78d46176b62252b98e7ce3b585a
- SHA512 c5ac5c076cd2db540877f5e9471e194f732b7567c0bfea2f4a8f9e3f7e5c4319be08605d9176d2ad354fe676181f2a97b6bf1b92c3726b39e8373061883b9fb0
- SSDEEP 98304:sQfpErvE+A1kvgp6hfNiE0C7wfhbDdCp:hxErsr1k4p6hWOw5X4p
- TLSH T1DBF53332C0E8C65FD7B4D8F592337F9F8A02484EA6D2015AA8797BC69A8F5F53D02453
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
12927680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE