b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2

General

Target
b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2
Size 2.3MB
Sample261003-lq894axtfv
SHA256 b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2
MD5 4044032b6d3ebf31a6ca562a41924717
SHA1 1264f644c8cbfcb733a9f8a5bae454f8cfd105b7
SHA512 b8b3131553141ddf1aa99b90136c6fdee0d2950f345bac7a09f505443014e974fa95ad83beac8a5fcc66119db4cc3b1a17ee692a20a8933c72a339dbadbc5f12
SSDEEP 49152:cIcNUXZFprf4peLt3BYxHFr2MGBHgUq739c+:QOXTprVLo5gHgjc
TLSH
T11FB5C001F5A180B2C2191A7035BE377FAA785E550B248AC7B3E4FDB97DB11E352B7209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2

File Explorer

b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2

.exe 2.3MB

b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2

SHA256 b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2
MD5 4044032b6d3ebf31a6ca562a41924717
SHA1 1264f644c8cbfcb733a9f8a5bae454f8cfd105b7
SHA512 b8b3131553141ddf1aa99b90136c6fdee0d2950f345bac7a09f505443014e974fa95ad83beac8a5fcc66119db4cc3b1a17ee692a20a8933c72a339dbadbc5f12
SSDEEP 49152:cIcNUXZFprf4peLt3BYxHFr2MGBHgUq739c+:QOXTprVLo5gHgjc
TLSH
T11FB5C001F5A180B2C2191A7035BE377FAA785E550B248AC7B3E4FDB97DB11E352B7209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

699019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=49, id=14, version=7299,

count=5, id=12, version=7291,

count=44, id=19, version=8022,

count=1, id=28, version=9178,

count=6, id=18, version=8444,

count=117, id=29, version=9178,

count=9, id=95, version=2067,

count=24, id=19, version=8034,

count=675, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=93, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=218, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=90, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=48, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

Sharing

General

Malware Config

Signatures

File Explorer

b6670591e3ca71a9ae65f0fc995f9da17725a6018d1f94200b891c3e253153f2

generic