290eb44f4f5eb3fa2c5c6b9585207253f210ba7b100985ef165e74375ecadbaa
- SHA256 290eb44f4f5eb3fa2c5c6b9585207253f210ba7b100985ef165e74375ecadbaa
Behavioral task
behavioral1
Sample
4J6JfeQv.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 290eb44f4f5eb3fa2c5c6b9585207253f210ba7b100985ef165e74375ecadbaa
- Size 510KB
- Sample260729-js2xpafa85
- SHA256 290eb44f4f5eb3fa2c5c6b9585207253f210ba7b100985ef165e74375ecadbaa
- MD5 1707d22a60c483c611b4261d3d41746d
- SHA1 4128a3172e38fe251328b3982b13ae25b14288ca
- SHA512 6e88a77ef6280310d3d98a1d9184f258e8362a670cefe78bea74ae00c4b49424ec204a24d9d63e248a55042059fab47a2f6c9c5e9cef04ab9fb95d8494436c46
- SSDEEP 12288:BUxXANzeYDzvoWrlLGveOEXHPzjwPoKcFeR01exEt:BU2H3v9rlCvuXvzj1PFe1xI
- TLSH T127B4232BF6762EC14C484FBE899C2C9E26985FFD48871473C483E2977D6104BEDA169C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/4J6JfeQv.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/4J6JfeQv.exe unpack003/out.upx
File Explorer
-
290eb44f4f5eb3fa2c5c6b9585207253f210ba7b100985ef165e74375ecadbaa.zip 510KB
-
4J6JfeQv.dat.zip 56KB
-
4J6JfeQv.exe.exe 475KB
-
out.upx.exe 1.2MB
4J6JfeQv.dat
- SHA256 31ee2dc2ae5b26dd85d529c4346bb8d99c98e480e7ce5704d728059a990d5ac2
- MD5 a0fd146440bc3fbd61e174066f99fb73
- SHA1 e22ef28423fc876dc3f983268faed7a7bdcc7b84
- SHA512 a548b56ef0cbc8a550349a2e0c28b61abab846a97ae36fb4bfced50c146a28fd5ac643dfe5c8235b47b7d3ab18f0bd756e21b8e2155d6fcd05a706435e8452f8
- SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJYY:LsUL1PSkbvG2pkze2GYY
- TLSH T12243020AD5F17B3ACA061776CD5CA50150EF4AFD88235CB38690F2764EE308F9D1B619
- MD5 SHA1 SHA512 SSDEEP TLSH
4J6JfeQv.exe
- SHA256 72ab7cdcb4acfe2a9ea15aa18d1bacda05292ab15c5fd7500a9e08801f937300
- MD5 76ec832351156f567823cecc40c1a6c0
- SHA1 1281d21d35608e459c253fe2daac666bb4af9573
- SHA512 21d13c2f17665f59a3660c3db6e35244ee5c1056a6a6cd4777ceb7678f7e3304a5d487085e59fbcff7ff34bd0206bcf6208f05268edf2ddb2c417cd725fee9d9
- SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/t:gthTiP+ffCfB5Lf0F7Z1EDsVt
- TLSH T10AA42322B76BD826EB0E083542A5DF7D897ABD02F889834301B97F5F7D363905D1DA09
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1269520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
800KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
436KB
Virtual Size
440KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=38, id=19, version=8022,
count=45, id=14, version=7299,
count=26, id=48, version=9044,
count=13, id=10, version=8447,
count=605, id=1, productName=Unmarked objects,
count=25, id=19, version=8034,
count=210, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=301, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=129, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 7ed4bfedcf8ce865db2a862cac15f2af1334d3b067e7b853353f79c970197288
- MD5 3e780809fac523c44aacbf224b0f4674
- SHA1 3cf693b24ff85a9fc77e7cbbfdcc537491e6cdd8
- SHA512 7629d02e766aa86635b09bba1ff3b45c14c3daa5f00186b85a276d0dbc4a4adb36f183e890c2525e96701e0a4259ebf8687be646ed355ee4edbeb48bebe2c30e
- SSDEEP 24576:wu8JzEgZUknnNzB43bz/3FDhMVGYkUmdNJhmtnjyFwTACQnss8sV:F8JqFVMEtHaho7
- TLSH T13C459E623892C036CA71C071CE7A97B5D7F1E9788E73498B6BC6D93C4B35C419226A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
729254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
916KB
Virtual Size
912KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
84KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=38, id=19, version=8022,
count=45, id=14, version=7299,
count=26, id=48, version=9044,
count=13, id=10, version=8447,
count=605, id=1, productName=Unmarked objects,
count=25, id=19, version=8034,
count=210, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=301, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=129, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,