2989_[.]zip | Triage™

General

Target
2989_.zip
Size 190KB
Sample260727-dsxp3svdkd
SHA256 28d6d54fb15ed680e48bb21fe67270b653f6b0608b7da0c8c692afac8b696049
MD5 b0fb18639327b9073e733fd538c5fab8
SHA1 67d9701131ed22c092b4eb058e7d786da7ba005a
SHA512 45f8d924a35199b5fd5ceb58ad24590ba4d17c8f8a32f05377d3bc92f5ddaa1c6bb34d5dd440eff52c799d9c1cf503e24ca9ea97afc1343bc97d1281afa3d3c3
SSDEEP 3072:qs7xBcN0ynOL6G1gisq+2wVuOONN83ePE894bSdlG+r8PoeSQuJIJ6l4evOZxYb+:qsFmEsqsVbOHR83wGHPoeS8J6eevOZ4c
TLSH
T17314220C05AE9924D83E9C927452B3FC5E27579D27CAC18A0CD2DEBBF16A1392CF450E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/2989‮.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2989‮.exe

File Explorer

2989_.zip

.zip 190KB
2989‮.exe

.exe 678KB

2989_.zip

SHA256 28d6d54fb15ed680e48bb21fe67270b653f6b0608b7da0c8c692afac8b696049
MD5 b0fb18639327b9073e733fd538c5fab8
SHA1 67d9701131ed22c092b4eb058e7d786da7ba005a
SHA512 45f8d924a35199b5fd5ceb58ad24590ba4d17c8f8a32f05377d3bc92f5ddaa1c6bb34d5dd440eff52c799d9c1cf503e24ca9ea97afc1343bc97d1281afa3d3c3
SSDEEP 3072:qs7xBcN0ynOL6G1gisq+2wVuOONN83ePE894bSdlG+r8PoeSQuJIJ6l4evOZxYb+:qsFmEsqsVbOHR83wGHPoeS8J6eevOZ4c
TLSH
T17314220C05AE9924D83E9C927452B3FC5E27579D27CAC18A0CD2DEBBF16A1392CF450E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

mysubsarethebest

2989‮.exe

SHA256 e574f7d4eb20cf213a489e93dbeeb44c1ae8a303fe29ae7e0fe86ad15f339da3
MD5 2f7fbe2755b98a6a33e21f68137345ce
SHA1 6e75f994ca9aadc57a3016b177f9f68717c13d47
SHA512 bf7ec76613a1214e92773ac2413d88c6916333a9f4c24ba6ce7cde1767bf16a8d90315928145a26ee49236c4666626ee1085a43534372857a0450876ad9ef98a
SSDEEP 6144:8qXxQLcc2kmP1ILeM3Q8gi980l6Y9hiG9:ZCLccZiISM3Q8ga/oKiG9
TLSH
T188E4019365B8B36CD84743F6A4F6C5BA245D6D323C27820327C57F8B78BA5F24235A60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

688960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Resubmissions

Sharing