6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173

General

Target
6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173
Size 1002KB
Sample260802-trqs5swfqa
SHA256 6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173
MD5 0eb3fe42e3e4289b31dfc80be5180a79
SHA1 4c8950438c5f862f79bbc0a6ea5ce0d8c882bde6
SHA512 f926834ad66ad80325bf7157c22824ba1bd2e8b985b396a2d0771a3dc611ef1b54373476df534daee2fab3aac8ead96d6ff3ae93a83f2225a667318513dc8558
SSDEEP 24576:T3KAoZTtufsAN1vy0jLNfPtNP1vZszoayu99/mb08W/:bvoZTYFFXltN8vz9/n
TLSH
T1672523838BEAE890D2915270DF7153F5DAAA3EE7DCE0388F24D2FE1BB83515105A7419
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173

File Explorer

6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173

.exe 1002KB

6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173

SHA256 6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173
MD5 0eb3fe42e3e4289b31dfc80be5180a79
SHA1 4c8950438c5f862f79bbc0a6ea5ce0d8c882bde6
SHA512 f926834ad66ad80325bf7157c22824ba1bd2e8b985b396a2d0771a3dc611ef1b54373476df534daee2fab3aac8ead96d6ff3ae93a83f2225a667318513dc8558
SSDEEP 24576:T3KAoZTtufsAN1vy0jLNfPtNP1vZszoayu99/mb08W/:bvoZTYFFXltN8vz9/n
TLSH
T1672523838BEAE890D2915270DF7153F5DAAA3EE7DCE0388F24D2FE1BB83515105A7419
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cc:2a:63:3b:5e:29:7c:c2:db:23:8c:2d:19:fd:ce:e9:bc:cb:0b:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Rasyonel,C=RU

Chains

Aug 2, 2026

CN=Rasyonel,C=RU

Subject

CN=Rasyonel,C=RU

Serial Number

04:a5:3b:ee:22:ea:84:ad

Issuer

CN=Rasyonel,C=RU

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 14, 2023 - Aug 14, 2033

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

0

Major OS version

6

Entry point

3353952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=47, id=259, version=30795,

count=224, id=261, version=30795,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=60, id=261, productName=VS2019 v16.8.3 build 29335, version=29335,

count=1, id=262, version=30795,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=253, version=33808,

count=27, id=259, version=33808,

count=21, id=260, version=33808,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=95, id=261, version=33808,

count=5, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=212, id=261, version=34123,

count=1, id=260, version=34123,

count=36, id=260, version=30795,

count=31, id=257, version=30795,

count=549, id=1, productName=Unmarked objects,

count=99, id=265, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,

Sharing

General

Malware Config

Signatures

File Explorer

6768d9482624e91404e0bfbfce626e24a62b705002290588ec87e08eea105173

PE Signature issue

generic