154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69[.]zip

General

Target
154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69.zip
Size 12.5MB
Sample260811-rdpyksvbla
SHA256 1cf03db170091077ac151c1d70a84e9d68e0e1b94a76e2114f6342c8226990e9
MD5 1b44d45cf11aa334d428505191291d67
SHA1 0c8441dc22da7a99acbff0725987309a4bf120f9
SHA512 9916ee76c612b22355c585731f98cd11b21d63869982c6e10ebb6824909d8c746efa37d307331d30d734f5aabec9aab3c1f3de76c9404d8d8e821b1e4b94217f
SSDEEP 196608:gRROaUJTF5fRzH+cLcdr3vqRjYi4fxkBY+3N9b4ewTXJDDTYbZpELsiWMrCqGeKT:gp4dzH+Jrfqok2ebtwNDHa7G7NGnY2
TLSH
T156D633C69EE738E3234712373FA3399671CA61CB61A64618DF60C948844CAFF7612BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69

File Explorer

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69.zip

.zip 12.5MB
154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69

.exe 15.3MB

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69.zip

SHA256 1cf03db170091077ac151c1d70a84e9d68e0e1b94a76e2114f6342c8226990e9
MD5 1b44d45cf11aa334d428505191291d67
SHA1 0c8441dc22da7a99acbff0725987309a4bf120f9
SHA512 9916ee76c612b22355c585731f98cd11b21d63869982c6e10ebb6824909d8c746efa37d307331d30d734f5aabec9aab3c1f3de76c9404d8d8e821b1e4b94217f
SSDEEP 196608:gRROaUJTF5fRzH+cLcdr3vqRjYi4fxkBY+3N9b4ewTXJDDTYbZpELsiWMrCqGeKT:gp4dzH+Jrfqok2ebtwNDHa7G7NGnY2
TLSH
T156D633C69EE738E3234712373FA3399671CA61CB61A64618DF60C948844CAFF7612BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69

IMPHASH 1c18fac98d5f2984f9a2f8f87ce709ae
SHA256 154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69
MD5 1a8224553b2a1fe68fcc786007d90d5a
SHA1 2aad61af409aff813adf8520e5639a5ca5d10f23
SHA512 fff4510bf82a161d46871997e90d1ee7a8353011fb29a92e64bb40da7cc1db88270f28a2f0f820e8b35de4ab81a90a43741c614d835b37d3eb886cf934809549
SSDEEP 196608:EVUasoUrwwXVyfW6MPUSyUw/KDDZ0NWpvYWoYi1D4yzd5R0mQ2fydYLjbeM:EVGr1lyfGyRCDDiNW7o91m2Ny
TLSH
T188F60143F69669ADC05EC774C70A9233E7F2B8894A20B29B67D84B612F77F60179D304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

3823648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69.zip

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69

advapi32

kernelbase

generic

Sharing

General

Malware Config

Signatures

File Explorer

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69.zip

154f9b3f71c09940a9b08e50febb92964990f7d9000c104e61d47ddef36b3a69

advapi32

kernelbase

generic