VAV2008[.]zip | Triage™

General

Target
VAV2008.zip
Size 766KB
Sample260930-fxnzvavycx
SHA256 9c003a0f6a23796f5b3dd3d01027eab4de21a252f79a93f1ce8920375901c89a
MD5 1e2f4850cdc42e42041df2f97a625c64
SHA1 8b4b790e8b09b7fe057b240ff78ef2eba6c1385a
SHA512 ccc66fe2398cb6afd2d45ae08edee730cf9bd47ff75c9cc0a8e5fd5a0e56a4183f85a5555ccdf4d7e494b1c30c4593352f0c5f95c3de22fa96b0c3f34db1cccb
SSDEEP 12288:ykRTkQS2EeRt0ShUplDIyF9aSyuktgtkfmSH1nMFxYLXt/NQTgFempwnvcvz7H+h:ykRThSNeRtnhUgy/stgtkpH1nMCXLPFc
TLSH
T166F423BFF1BF684D58269966C27DCFC7497876671C82FE65E6202A2E300C0351BE461B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/[email protected]	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/[email protected]
unpack002/out.upx

File Explorer

VAV2008.zip

.zip 766KB
[email protected]

.exe 770KB
out.upx

.exe 95KB

VAV2008.zip

SHA256 9c003a0f6a23796f5b3dd3d01027eab4de21a252f79a93f1ce8920375901c89a
MD5 1e2f4850cdc42e42041df2f97a625c64
SHA1 8b4b790e8b09b7fe057b240ff78ef2eba6c1385a
SHA512 ccc66fe2398cb6afd2d45ae08edee730cf9bd47ff75c9cc0a8e5fd5a0e56a4183f85a5555ccdf4d7e494b1c30c4593352f0c5f95c3de22fa96b0c3f34db1cccb
SSDEEP 12288:ykRTkQS2EeRt0ShUplDIyF9aSyuktgtkfmSH1nMFxYLXt/NQTgFempwnvcvz7H+h:ykRThSNeRtnhUgy/stgtkpH1nMCXLPFc
TLSH
T166F423BFF1BF684D58269966C27DCFC7497876671C82FE65E6202A2E300C0351BE461B
MD5 SHA1 SHA512 SSDEEP TLSH

[email protected]

SHA256 47769a82ac9994bf50fdb7ff521d2364775afea3da02d55450448a25e6f94645
MD5 8cd7c19b6dc76c116cdb84e369fd5d9a
SHA1 5e3ecd3e4ef8adc294db1e3525cdbde46b2b7ddc
SHA512 909d0a2ec4af33c374d7453926e5999badd2f9fa79d0648a7308f63911f673ae34ec275917999199e9fb3a669af5c4aa460e7639c5e346f261decd28b520039a
SSDEEP 24576:ePPNsFNARXFh0Gy9Gtgt09HlncQXZlFeI5D7Cj+o:RNkltHXXZlFeiHab
TLSH
T1E5F4233FE1BB9C49C86195B992BD8FC78578F5331881FE6A96713E2F30194B10BA411B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

133744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 e54d540511a70a22c554b57bfade4bc422ee580752e62b1d980eee05b37a965b
MD5 184be8ee1bdff6efd69db6d5660043a9
SHA1 1a18cd50b2ebf2bf6f61ff8bcb4b7e73375d95b5
SHA512 111a2b39989e681b0ed50d635fece00a7ae6c13dd2718a62c4723f8a2e3a72f2fe1f6578c6fe93223dba9151de941e9f89f2e362143219e32f38156c37287afc
SSDEEP 1536:pWXb/dpkj+McLGqEIYebgLBZvF3BTJVTmrvPhp5qlS:pWDdpkGLGqEIYebgLBHFTmrnb5q8
TLSH
T1D3935B02D7C781F2E5821A7058BE6376E13DFF512F35D29FC3A81C6A6C71A12F50826A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

VAV2008.zip

[email protected]

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

VAV2008.zip

[email protected]

generic

out.upx

generic