WarKey_6[.]3[.]rar

General

Target
WarKey_6.3.rar
Size 54KB
Sample260727-pnl9bsswhy
SHA256 1d7ad3bf621c5867eae819cd51747d7fd285ffe8cc97a09e22f969e5e6c862a1
MD5 442cbaa7a56fb94f6937ec89f017235a
SHA1 9e3ebad0d898c2e9f35eccdda796b1af840693eb
SHA512 3f4806aedd544bc28323f8b021145a6ed58091cf088ba3e290495f98984b797600c1c7ccd5c19340643d613d97e2d2bd7f8d1f115e65ddb6315aea652130e594
SSDEEP 768:1c9T9eyvYIUslxrZvxcqcVYbvQXyBH0pAsPQ3TPwW6n2UKC7jnYA4iyE3C/uREwU:aN71TI6vQI3TIWJUKC77YiX3tZQ2vM
TLSH
T1F843011D84F099088AEC060A15FD6FF36005801A607453A6FB9AA239EFF49DAC5EBC48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/WarKey.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WarKey.exe
unpack002/out.upx

File Explorer

WarKey_6.3.rar

.rar 54KB
WarKey.exe

.exe 66KB
out.upx

.exe 212KB

WarKey_6.3.rar

SHA256 1d7ad3bf621c5867eae819cd51747d7fd285ffe8cc97a09e22f969e5e6c862a1
MD5 442cbaa7a56fb94f6937ec89f017235a
SHA1 9e3ebad0d898c2e9f35eccdda796b1af840693eb
SHA512 3f4806aedd544bc28323f8b021145a6ed58091cf088ba3e290495f98984b797600c1c7ccd5c19340643d613d97e2d2bd7f8d1f115e65ddb6315aea652130e594
SSDEEP 768:1c9T9eyvYIUslxrZvxcqcVYbvQXyBH0pAsPQ3TPwW6n2UKC7jnYA4iyE3C/uREwU:aN71TI6vQI3TIWJUKC77YiX3tZQ2vM
TLSH
T1F843011D84F099088AEC060A15FD6FF36005801A607453A6FB9AA239EFF49DAC5EBC48
MD5 SHA1 SHA512 SSDEEP TLSH

WarKey.exe

SHA256 ff1727e5827a02b79255e44c7b47ff9dc987fe95219bbb5f2ecf6c8d7a4ef391
MD5 399d975593f5a1aa2d0a05ccf583fa5d
SHA1 3cd5777e8b143704883272222d73112952955a63
SHA512 19a76c925f5a0c3bd6aa72cc1704faa741b03b7b94d7227627c146f451dbda8f8b36bcd21d1ccd0bc2e47d1ae6d4a96e0a327ea428f5abc6b82af2e23d7eca6c
SSDEEP 1536:wfvh5nGv1FZe1x1EwjqXtGMQqAX7dOh2HjYXq1YsA:wHGtaLqXtVAX70cZ
TLSH
T1BF63BE937694D801C9AA0B328CA7D7858334FD669F4A831F7148775E6EF3AC08C5A6E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

232224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 23bdb2b7e549186d2a8617c0c4a6d25dbad89f75c309d0c102e6d7313fe6aefa
MD5 4122f657486124734eda8fa626c1a4ef
SHA1 3b39ee97425efccdba2a26d2281672cc75a9abb8
SHA512 6c10de3a9c5e24d556eaa3d2c7c05a858d29ed57c5c657a1ce2a6b48be12567c6ccca34781f940193ca7a458271e1bc6ddb7ac7285b53208eb8ca1c8dffe9514
SSDEEP 3072:FDqiZfY7ZOy546ZJ/tp1SWdINuWwvkb+/hL2ZS0cZ:Fgj54ondh2ZS5
TLSH
T14B24E623B944A216D82246710DBA6BB87A267C2541414E0733C5AF4D3DB6BC3BDBF52F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

WarKey_6.3.rar

WarKey.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

WarKey_6.3.rar

WarKey.exe

generic

out.upx

generic