StaticASPackUnpacker_1.00.rar
- SHA256 e0ff42894c8a4db9b9160c51d096c05bf00298df25c94b6c168344e480c0fd77
Behavioral task
behavioral1
Sample
goat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
goat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
unaspack.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
unaspack.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target StaticASPackUnpacker_1.00.rar
- Size 25KB
- Sample260821-pd5b6atwex
- SHA256 e0ff42894c8a4db9b9160c51d096c05bf00298df25c94b6c168344e480c0fd77
- MD5 82db89b87083d6615aa68d9b4981b38f
- SHA1 3673ff3f1c1a50bfa817adf390134ad191669a79
- SHA512 d1b96977dd0d94b2dcc5daec35da81bd8433a1be40de16018228860fa9bb0a5f409b751e86b812ea95280c355795d0e01afd754b88f0b69aa2f5b032221a21a3
- SSDEEP 768:wMumhYFL+GPf3CX6JgY5ZNXgLTrp7FbsiQ:eWUtfCX6FNQfrp7Fbu
- TLSH T184C2E1ABB57404BB58EFD4F642BD0EBC57F2954A40F2B967B50C8C130D5C731892AE8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/goat.exe aspack_v212_v242 - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/goat.exe unpack001/unaspack.exe
File Explorer
-
StaticASPackUnpacker_1.00.rar.rar 25KB
-
goat.exe.exe 8KB
-
src/lzxdec.c13KB
-
src/lzxdec.h2KB
-
src/resource.h778B
-
src/unaspack.c38KB
-
src/unaspack.dsp4KB
-
src/unaspack.dsw539B
-
src/unaspack.ico1KB
-
src/unaspack.rc3KB
-
unaspack.exe.exe 14KB
goat.exe
- SHA256 7002c938c81f8d2fa11eb352a265ad43895d12c1143d226f75cc8ced7106b0d0
- MD5 46b7d1b3c88e5d6067cc20fc6a12c048
- SHA1 533a94b0d7c582829972477ce037656a64a647bb
- SHA512 2ea70cd9998390967e6da19ec5a85e6498c1054bb334aaf829369879b9b81b1902c7670db81c807661c22c9bc4010be4dcf2ab8d4d987aced27b70f1c896b295
- SSDEEP 192:GHaPuvAxJwCMrpY7S8LqPZo5LdCfuR1nuO3:GHDAxJr6+S9Pfu7n5
- TLSH T11A02F9A3EE4084F5C8CD2937018769C3997BAC72832682B353F0349D7CB51A9ED6895F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24577
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=19, version=8078,
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
src/lzxdec.c
- SHA256 3539d39dbe78afa698b06e4568f4c1de67b6997dcc02a297e44666e52b2101f4
- MD5 186e23773eb147b313319f846e1935c7
- SHA1 d8b504de54c5e9164fa0e8c6b56f437bbe34d30b
- SHA512 7bbbb135e3cf80be462c0750a4e3d93e03586a913984c54501e0f1dbfa3b5c3d3f1a4352d78e6338b79e251292409154d25b8ef7facf9d639928870ab34b3040
- SSDEEP 192:pVDKiMMGEuPthoW2RGnH1EQOLINHPM49+LFzqQt/Wb1H:7DKVXhbnH1Jvkht/Wb1H
- TLSH T10452DEE40D422062E73BFB789309FC29E91EB0971CEF1585756E40709F76A20A5ADF5C
- MD5 SHA1 SHA512 SSDEEP TLSH
src/lzxdec.h
- SHA256 4e76f29a3e625e317a30f347bb666f23df26ddf8b747869eef633b34b62e0c4a
- MD5 ca2621dfdea051763b1cdb18fa19592a
- SHA1 ad6431359d74118e5c84bb1c4711e004cd919435
- SHA512 6aee83583e9da0ac7425a2585eb92803ef19d680b95b183e204d306f3b7a0ff36449c9fad6816e9dc1ca85d86a866aec325fd427742412a5129b3167faa4de04
- TLSH T1AF517C521CDF70630E74D5122756F957E6ACE0DA0B80B0C438EE97751B2CBAA419EBD8
- MD5 SHA1 SHA512 TLSH
src/resource.h
- SHA256 24642e374feaeca0a00c698eb9e1075a87faf4b0c5b031800bdb88af65574e03
- MD5 de5e18f7197ab93a20d6554efd4e6476
- SHA1 6fc49da711f3069c3f4d75ac266a5632ef62e369
- SHA512 40025009ea35a5bc4468d48a2eff16cc1794c0da2ee40870847a4d408fea797152e0ef69cefe729cead60a752f41165f5d28664a98b88c8d8ff04dee8de269a2
- TLSH T10E01D1398CD498AB6478F0C500199602158CFD6755A846AE72CC6DECAF2655202FF1DE
- MD5 SHA1 SHA512 TLSH
src/unaspack.c
- SHA256 be09dabb0f55e8d7c03ccc8dc19327d812e7fe695f4810e8db1774da0531da61
- MD5 12843db0de6e7f8ac64eb6ba1365f48c
- SHA1 5edc59fbab398bfd3ffe05dbc64c5b64a84fa4f4
- SHA512 307d162d0dbd9fc654978517fdd783049fa1cc6339601108ff65fe527c06a923919c8e7a99effdada932eba4bedc684c9be7947b1fff7704de3137e0b056a757
- SSDEEP 768:cg0sQC6OL5b8yFcH7t8dfkjnywkNd56B6S8geJamycarl:cs/6k5b8y07ydfkjnywkf56BKgeJamyr
- TLSH T1310395952C8231A34AB6C3386B039404E79A541B0F6696DC749DC2F51FB56F4C4BEFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
src/unaspack.dsp
- SHA256 40f4f151aa48763d1432d8c38465ca1075ae7641d1df34b58e91fa108a95e771
- MD5 ea410c1c24badb782a2e45e6de406d52
- SHA1 e8585ab0fb303c0b6968f324d5fc381cba240b30
- SHA512 5b84c34da1d3fdef04bf52941bdd81f26fd5b5945fc08594d3dd8cff26435ff685837a5bb585cb31a80f1d24220078920c073131c3c43f1f2d3491b99e5a5f7c
- SSDEEP 96:yOa8qK8elcfhQNhNQEguTGT1GNCNvrCqTPTjq2N/b/0z4xWypiYIh:HX8qkhGO1DLr/b/m4RpiYIh
- TLSH T11E91002BA0409718F2F63F5DEE4FCA28E4E9658E0A401A4CFD50D49F5E3266B46812DF
- MD5 SHA1 SHA512 SSDEEP TLSH
src/unaspack.dsw
- SHA256 49b0e5dbd49b134f9e62df231b011e60a7b7c82420511d83cd388b5740e0e45a
- MD5 349b9a4ef38dacbf038d538ed35fb88c
- SHA1 62c71374edc4442b11ddae88f7964700df23590b
- SHA512 17a4d516c57994bc150b23ae3ee4dc57797e39d34a1dcb0d6289e65df8a1b1cd53f1c8375e0dcc2a990b95bae393aed40a7f323d0fad8094e343b944f854f743
- TLSH T1AEF086C423E75D157B716C182071B4117DCDB1FEBE4F4C98706C991691127C0D0066B9
- MD5 SHA1 SHA512 TLSH
src/unaspack.ico
- SHA256 d84d2a68c7a260998cfaebfcd3188d3f52e9645c6f2e1297902af2e50e1d5b0b
- MD5 4f3c7b0f9660b9c1071242b55733a592
- SHA1 262c43c4ce06e224fe26df8a6b43d6ccb818b0e6
- SHA512 e8f3e86ff57c880638b511c2d3d36527c66e20a510d37c4f20853e6515c658d82e458424579789aa7a4aaad4adae29cc4478ef98d19c9b8df57b71ae00b63c19
- TLSH T183118C9E220033D8D8B6067B8C1B7B6455B96C617E561782A394B4DE3C33330B523DAC
- MD5 SHA1 SHA512 TLSH
src/unaspack.rc
- SHA256 6f680772278e9da25c3fc002b02b61aa4977221dd4b70fec4ceec08398be0102
- MD5 e0d8a647cbddcccda0a00ea8aa0db001
- SHA1 687cbb4b5cb209b5c71bc55afb9ab3bb066f36cd
- SHA512 27c5fb37641831382593985f15bed6a50b00c3c2c33fcbed22f811d6f30595cdc2bc0a9b0e5c5d0fa049ebf9e33dfad82342d470b231460fd4770bdc812169d5
- TLSH T19D6142628A4391738735B0F11D012F6AD179953F5AA58B18730DF5EC8FB794502EC8AF
- MD5 SHA1 SHA512 TLSH
unaspack.exe
- IMPHASH 8abbd5b875c569dc6c0e441a1de5263e
- SHA256 32aff2c25719d4a0f9fa41694f0498dd854ae8223c0afb5bd12992857567fbcb
- MD5 6a8f1f151d0dd920686b4c6d3f7a39d0
- SHA1 1177e882ed923abc1a3b19e7c5f12a6a0c55b91e
- SHA512 3f82d9b4368d9b46554580f5dbe2656f4f2bdac6e5e81be2b568c16edd02f0b23727869f9157fd0148b69822866179f4949964acddd43f95aa0ae7281994f654
- SSDEEP 192:ylzKlqf5DbmSmCDFVRxDeNuRS0gAaVLGWAzi4zKWxBuvq3N6nSr92Yy2:Syo5RdnCKWAG4OWxBN96nSR2Yy2
- TLSH T1DC523A4A5E4406F1E8A5057140AFAB719FBEE9B543524F0B9310F1AD29332F2B9F62C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
lstrcpyA
lstrlenA
CloseHandle
VirtualFree
UnmapViewOfFile
GetFileSize
GetModuleHandleA
CreateFileMappingA
CreateFileA
VirtualAlloc
ReadFile
WriteFile
SetFilePointer
HeapAlloc
lstrcatA
GetCommandLineA
GetModuleFileNameA
CreateThread
GetExitCodeThread
MapViewOfFile
Sleep
user32
SendDlgItemMessageA
SetWindowLongA
LoadIconA
GetDlgItem
GetDlgItemTextA
MessageBoxA
SetDlgItemTextA
GetWindowLongA
GetForegroundWindow
SendMessageA
SetWindowTextA
DialogBoxParamA
EndDialog
gdi32
CreateFontA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
comctl32
ord17
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,