GenP.v3.8.0-CGP.zip
- SHA256 d055bf83f14977bf9063b81bb9ac3abc62bef6e800f3ca59c175731d2f0fb44d
Behavioral task
behavioral1
Sample
GenP.v3.8.0-CGP.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
GenP.v3.8.0-CGP.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
GenP-v3.8.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral4
Sample
GenP-v3.8.0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
General
- Target GenP.v3.8.0-CGP.zip
- Size 1.3MB
- Sample260820-tr4p1aed93
- SHA256 d055bf83f14977bf9063b81bb9ac3abc62bef6e800f3ca59c175731d2f0fb44d
- MD5 0d16f363d26c51192561949a12d78d25
- SHA1 6e4d5814abe7ee5922ea3a0ee6253d9501620042
- SHA512 a87103c722e48d718e86969e304a350bd50cedbc6ffbaf15a6e19009764ff6162d9ae220d183d451dc3e32bf84007caa38434498ec4d622ebd50fd9a4343cf02
- SSDEEP 24576:hJFoPtPvjvohXTMnNayQTvyqxF8XKUIuULR+EzvSBfSRFlGUVQbTTg:TqFbAXTMNa9OqBUIuUtpvSBf8Ghk
- TLSH T1DF5533EDEA00588F626787DC0CE6CE85757F594C52D61692BAFA0DFE37BC5402A1AC0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/GenP-v3.8.0.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/GenP-v3.8.0.exe unpack002/out.upx
File Explorer
-
GenP.v3.8.0-CGP.zip.zip 1.3MB
-
CGP.nfo33KB
-
GenP-v3.8.0.exe.exe 1.5MB
-
out.upx.exe 2.0MB
CGP.nfo
- SHA256 fe8c42e215a2e2557358e9a89e7e6093eff84676d33c74b7f31f2d1a427098b5
- MD5 18dfc3601330af51c35e20876b891386
- SHA1 2c645dae33e396a81cdba2fb168140417776a0f0
- SHA512 69fdcdf341f0210647f61c7d0c8b5f83fe83552c15e8d5e2bc79985ad274a50ce2f5d86cdc567a6e79c1d1dfe4e524e5918a3d308789c2c289d20d77b96b3954
- SSDEEP 48:SrEFhZ4H9zI3DuEZJHAKjrmAZhBdzWMMMEM2MMMMMMs43MUMMMMMMMsUpMMMYMM8:SrUeETKZJ8QmCYQYPpdohAZ4tpP
- TLSH T17DF23E7534F737414F214EA71A18CD7D9B999BE2AFF60885F0DD1809AB209B21B442F7
- MD5 SHA1 SHA512 SSDEEP TLSH
GenP-v3.8.0.exe
- SHA256 6721aaaa5b8a0bbc1bc68797e6b5f32b65129896c4e2e082f995446f7a9b5f8d
- MD5 938f882042e92e36d1450813daa897ec
- SHA1 415e123f7d81cb813eff5d7fa17dddbd58920943
- SHA512 2acbb893831dd3f02d1b965ea9114092d93994632fd7b7f39fbebd648799275845e286ba909bd70bfd7c2930069fe2352c5a19cd47c1ed933843fd86c0aff0b8
- SSDEEP 24576:P0/wH2fMinErsWguWH1G7eQtT/ihLTMnNa2ETtyqfF8XAU4u6LRWEzvALfARFXGX:sW2frO1fWg7eQtT+LTMNa7YqrU4u6tBI
- TLSH T149652366F78093A3E1600330D9E7C708323AAE5EDA522AD771D976FE78FD3406117869
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
2162288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
409KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 03c34b0860107e274511ed5e092c319fef75c567dfba220638ebfedd3c4052d5
- MD5 8a836c8d51cf45d4418e5fb2d9300312
- SHA1 e72b9fc194a54a2647d7d13e3a82cf7104c449c8
- SHA512 d019536592eab0295c877bb0c741421bdad66bb4b8e90f3aad8c1fbdbd2e77affa584ed99457d8b17232f1ab1472e826ed595ef90c6ad78c3aec20b5f07c0d05
- SSDEEP 49152:i2EYTb8atv1orq+pEiSDTj1Vyvk7eQtT+LTMNa7YqrU4u6tBvALfuG9:fXbIrqXtTo9cqrUF6tBvAju
- TLSH T1A7A5D01973A441ADFEABE176CA13C60BD7B1784902B7862F01A46B763F33771562E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
152732
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
717KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,