123[.]exe | Triage™

General

Target
123.exe
Size 1.9MB
Sample260925-nd6dsaz1fv
SHA256 7305757e3b6838ca5585dfcc19c4d35964cd6a2fcdd6ca32d233b77b08cb9800
MD5 0702d12cb676b558c0d66c3db66fe841
SHA1 c909f4df2552acfeb4c8be9ed6d6a943e3ee5b0e
SHA512 2745030c98082be1b502a7621ec746d1d34ea74e7bff3fb15e03cba8301b526469f079d852798730898d72c4ff418aac9f191c24a29ba2bdbee8bbb1d99121ae
SSDEEP 12288:6mOKMMRFseUvaTiiX3Q8FJ8VFIREGMgg0+ut17pIRzQQbQQRQtzQsQQFvFQczQXh:+KMMflpdEJ0+ut7o91hGhaDmoJ
TLSH
T15595E622FA008A7AC52018FD7757D69DBFBA0456FD40E6A8C7D4CBA6DE7A07070464E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
123.exe
unpack001/out.upx

File Explorer

123.exe

.exe 1.9MB
out.upx

.exe 1.8MB

123.exe

SHA256 7305757e3b6838ca5585dfcc19c4d35964cd6a2fcdd6ca32d233b77b08cb9800
MD5 0702d12cb676b558c0d66c3db66fe841
SHA1 c909f4df2552acfeb4c8be9ed6d6a943e3ee5b0e
SHA512 2745030c98082be1b502a7621ec746d1d34ea74e7bff3fb15e03cba8301b526469f079d852798730898d72c4ff418aac9f191c24a29ba2bdbee8bbb1d99121ae
SSDEEP 12288:6mOKMMRFseUvaTiiX3Q8FJ8VFIREGMgg0+ut17pIRzQQbQQRQtzQsQQFvFQczQXh:+KMMflpdEJ0+ut7o91hGhaDmoJ
TLSH
T15595E622FA008A7AC52018FD7757D69DBFBA0456FD40E6A8C7D4CBA6DE7A07070464E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

321

Minor OS version

1

Major OS version

5

Entry point

1871520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 beabf76a4683ce4a1abbafaf95721e8bcd4521a6167e533bd084c72d81203fb6
MD5 6e53daee489ed4972d61f25a2373d2ae
SHA1 c95ae19edbe797714ab06b100b0201fc799882bf
SHA512 13c45ebb8908056e9d52d2f3d5601fb673e93361990b69cb45d59450320f56aecdf984ef2ac3810b78e07110742d5a6704e30858c448395550e3a1b4a2c29b77
SSDEEP 12288:xL9zqWN8+1QjsWVhMH3eRhyTiiX3Q8FJ8VFIREGMgg0+ut17pIRzQQbQQRQtzQsb:Xz18ZoXH3jlpdEJ0+ut7o91hGh
TLSH
T16B85E622FA009676C52018FD7757D26D7FBA08A6FD4196E6C7E5CFA6CE790A070060E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

145557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

123.exe

generic

out.upx

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

123.exe

generic

out.upx

generic