BlueScreen[.]exe | Triage™

Target
BlueScreen.exe
Size 9KB
Sample260912-twc3vaee38
SHA256 14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160
MD5 b01ee228c4a61a5c06b01160790f9f7c
SHA1 e7cc238b6767401f6e3018d3f0acfe6d207450f8
SHA512 c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140
SSDEEP 192:+fD9Nr7FhGYGkYPtkavYYGD6eXLeBZOic7b:+z7FUYGkoVRGD60EZOicf
TLSH
T14E123B86A3DAD469D89E02322DD34E61547ABC2583A8C3FF1D74028F6E71BC05D3127D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
BlueScreen.exe
unpack001/out.upx

File Explorer

BlueScreen.exe

.exe 9KB
out.upx

.exe 14KB

BlueScreen.exe

SHA256 14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160
MD5 b01ee228c4a61a5c06b01160790f9f7c
SHA1 e7cc238b6767401f6e3018d3f0acfe6d207450f8
SHA512 c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140
SSDEEP 192:+fD9Nr7FhGYGkYPtkavYYGD6eXLeBZOic7b:+z7FUYGkoVRGD60EZOicf
TLSH
T14E123B86A3DAD469D89E02322DD34E61547ABC2583A8C3FF1D74028F6E71BC05D3127D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 37244486200c96afcf720773d099047044963c4e8b533f319d82fc36fce2260a
MD5 4dde68ca990474be3dfead8423370449
SHA1 b37adc6b8e9f17116ccda0a9cbeb15d923ba2b58
SHA512 c7b5b45a52afbb387ca31cb72a8fc69a49ff37f0e0fcb974e78b7485670eeea61c814b40a1207a6b7b91b07af4ae9066a65181175e6a268f31c5fdd3075a6086
SSDEEP 192:GsXG6zbQpUeEW2HFogvkBLeBZOic7bh48C4:dXGOfeEW2HFogvQEZOicfh48C
TLSH
T12352A50267E54838E6EF45740DB71B6D0BBA7C224724C6FF0772088A4EF19E09D36366
MD5 SHA1 SHA512 SSDEEP TLSH