infected2026100301[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
infected2026100301.7z
Size 13.8MB
Sample261003-vs3d1atbja
SHA256 b5b648024b0d1d9c687fd6b54f1e60b0747b329141024fb61600e8fc448d5525
MD5 7a513aeca19d3e63bbe6fb6067f9c93c
SHA1 b967b784ae6a66b9ee50358aa392f4a642fa987b
SHA512 3b09494db252202185009edc8c9def24fe76793a227327a744f9ded76741b25899741b3a1b936beabed04083358315c7b9c11fc554c209300cefbdc1a7281455
SSDEEP 393216:WqvxN5/BbNeFS8xxmmZtUoSz0ZnE6RCYQ/dTmH9woh1:WqTbYFSImmZtPrndRCl/dYwK
TLSH
T18DE6336C6397FEC9B70F5B970A8D6FD02964D5B6A7285032EF622FEB443F9849003125
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/x64_upx_test.exe	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2.exe
unpack001/MicrosoftEdgeUpdate_x64_1.exe
unpack001/MicrosoftEdgeUpdate_x64_2.exe
unpack001/x64_A_nolit.exe
unpack001/x64_D_go122.exe
unpack001/x64_E_go122_notiny.exe
unpack001/x64_F_firefox_tls.exe
unpack001/x64_G_noutls.exe
unpack001/x64_upx_test.exe

File Explorer

infected2026100301.7z

.7z 13.8MB
2.exe

.exe 11.8MB
MicrosoftEdgeUpdate_x64_1.exe

.exe 6.7MB
MicrosoftEdgeUpdate_x64_2.exe

.exe 9.2MB
x64_A_nolit.exe

.exe 6.3MB
x64_D_go122.exe

.exe 5.9MB
x64_E_go122_notiny.exe

.exe 7.1MB
x64_F_firefox_tls.exe

.exe 9.3MB
x64_G_noutls.exe

.exe 7.1MB
x64_upx_test.exe

.exe 3.0MB

infected2026100301.7z

SHA256 b5b648024b0d1d9c687fd6b54f1e60b0747b329141024fb61600e8fc448d5525
MD5 7a513aeca19d3e63bbe6fb6067f9c93c
SHA1 b967b784ae6a66b9ee50358aa392f4a642fa987b
SHA512 3b09494db252202185009edc8c9def24fe76793a227327a744f9ded76741b25899741b3a1b936beabed04083358315c7b9c11fc554c209300cefbdc1a7281455
SSDEEP 393216:WqvxN5/BbNeFS8xxmmZtUoSz0ZnE6RCYQ/dTmH9woh1:WqTbYFSImmZtPrndRCl/dYwK
TLSH
T18DE6336C6397FEC9B70F5B970A8D6FD02964D5B6A7285032EF622FEB443F9849003125
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 571357510e1b8d02adabd53acca25bc1178b58ae8a75a70a1fe0fe17a6bbaf79
MD5 806a764017ebc93f496bd00181a662fa
SHA1 b03f04c8bd514468c6d549ada8801973e0642f2c
SHA512 8f00e9485d6acd45f08acb804ee1d0eec2b0c3a185c1a37f00353076f00c430dc71ceec7f5297358418abf39ba4c1efaa54218f1aba5fd5f2c78e2b9640e121c
SSDEEP 98304:VzHUYpI9zPvSNTqQrF0vO7bNzKE1b3RNZO:VozONTqWF0sNzXm
TLSH
T139C63943E8E60C94C4FDC2B595398226A971785D0B7A23EF57A1B7302F337E15A79B80
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

425792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

7.4MB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

248KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

MicrosoftEdgeUpdate_x64_1.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 85a79d513797127c4351a678619b1db00a2723ab8c0c4402da5de4d85bb596d4
MD5 769ef0f4fc2d8837221da7e350b90ffd
SHA1 cd513563d1f4d2cb5607f00922fa90f4d35e3d91
SHA512 db6ebbae7d02e090eac8d11cf37ec8a5a3f705704b1726cfeac01d902a67a70f96fd54981c110306b5209527408a127352a8a3200615c9986d6910c71e667aa5
SSDEEP 49152:3wZdFgUUZGQe2YsXfZoEFeWZgDL+Z11QGkZJUuYuDrH+RjPU5EgKAtqF6dlVeUjv:3U+RY+Z0GiDrHFElgdn
TLSH
T115663947EC9505E8C0ADD6358966A253BA727C484F3163E73B60F7382F76BD06AB9700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

474880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

311KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

MicrosoftEdgeUpdate_x64_2.exe

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 2802b27a88f12cba4989dd8da323ecb473a01d3ed8bfcde3a6279225fab91206
MD5 a4483899cbd0db1ec6fec12b37183f26
SHA1 4355750db77a455b2887153c6095652e7ac35411
SHA512 8d6dc65a46e67c259ee6f4cdf09b29467c73a0bca5ba81dc6fe82e3966f3eb01b22224a9def5617af9da0c85c82022d97b9b8c2cb7f6993f980adb2a2481a958
SSDEEP 98304:v7eRsbRBgpR+V7QMotojlmsvyUfE4Iy0czHeE+rjC7:6qe0V7QMoK5aU84Iy0cM6
TLSH
T1B6A65AC7F8A105A4C0AEE3348666A6937A717C484F3167D32B50FF682F36BD0AA75750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

448864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

495KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

x64_A_nolit.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 9e283c48302911e4f3119ce7badf2f6dbecd0435fcc02545d532ae7b9f86d5e7
MD5 c9712e4bbdcc574a1dbdc48946e640c7
SHA1 8d8ae6a5f21cc1ac514e1f1974d4511ff3fe1316
SHA512 3dc36d1817c92f57afa6e9601cd8511ce0d52b89133fe3c00e8b501fa9232a320ea7a1c4b4d68bb582c2bc39a5998d1a1583a3ef3767eb5558b2e130c892e9be
SSDEEP 49152:0YZRzcpmujTA7DYVcweOT8RL088uciCRFbbbZniDGGpx8X5jDZ5E0bzQU7dtwz/h:0a3ujarj8ucLcx8X9E0b8Qdc
TLSH
T122663947ECA141E8C0EEE535C62292637A727C484F3167D72B50F7292F76BD0AAB9710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

425728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

310KB

Virtual Size

622KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

x64_D_go122.exe

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 141372e8cdc0fd6fab0a1e7b265f19519d8f87011f40a462341ca605d0baee9e
MD5 b6bd90624a6a25bcda4f4f9f27c463f7
SHA1 350051f8277df005fbad6165291f30d009133169
SHA512 999da5fde9d950eeeb85d1bfd4367c21cf7058d8559795e3de3f4d20409cade88e658b2d8a250963e1ecabec1458d5beae94e7b98685cf2f2e6a93804fb81847
SSDEEP 49152:7eUuIGwZ3jNxms1D3GcFk1LmmoaAN//wSzWjr85EdCeR+4PQEE:IInj7Zk1Lg3v7E8e
TLSH
T1D6564A47EC9500E4C0EED5358A26A253BA717C884B3423DB7B50F7282F76BD46BBA744
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

398944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

305KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

x64_E_go122_notiny.exe

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 a2fe7919fd1f58503db121ba71c031a401d462be0f889d61a16198eeb358cfe6
MD5 ce0f142a3f5a8fed870cdd48dda5a36a
SHA1 e2ca06d0fb5cf9549f7b7fba631a6a8c54ae0c96
SHA512 5d2552294fbf6189be202058b39d63cd094915942f8c1afd33c74c58bb66e2d6e1b9a931dbd40c2f888e1f6c91c69e132cd61a1c10e8d7ce723576487be38446
SSDEEP 49152:M/WM30lWoHsVnRkb7JcH+aLLlTD3D5jR5wum43kBzudCVjBe5EtyOOWnmI9/nk2h:p3Q+qXD3D5bbEtmq5rm
TLSH
T1C7763AC7F8A055A4C0AAD33689629693BA717C484F3127D72B50FF682F76BD0AE75700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

448800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

305KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

x64_F_firefox_tls.exe

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 6f016cf9a5f75bfec2e76b1a968f2929e301acc4748b100fabd7809271e32543
MD5 7d0409559f923618998ca226599a3fae
SHA1 d608acb3f50997cd49a5a1bda0a7b34d561c8938
SHA512 dad52b4aaa619beeb37b9c5db32aaa865ba3acb7720eefbbc942057a7a4b15fadb6435943af333a69fe06954478cd8f1ff7bc734c50fca474d19ceec76470da9
SSDEEP 49152:K4kCYg5RgHuM68hXn1f9OoTgmR1NCLSq9jkOGpicrEHCyVnFCTjMM5ERKURSXc+3:wARgHv68BSk1gLHmA1yEaXtb
TLSH
T1B8A639CBF89105A4C0AED335C666A2927A717C494F3123D32B60FF682F36BD0AA75754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

448864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

495KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

x64_G_noutls.exe

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 f76d388d3c85e1a7dbbaef07c4e9357a910106337a6006ddd65e61ad3ff12296
MD5 d1f7c1f4b560fc5e6718c44dfb53d116
SHA1 b37e84f25f50411282cc48383c8cfbf6d0099a38
SHA512 49ec783f4125019d47e6c8696bea16d7d9d405876ac584dd0dd412f08bf307e37283451b357941a751a44f95aabbf066c86d2f9c65f18638516a084764e10c05
SSDEEP 49152:ELmNTnjjCFuVZntMhYwLq21pjwdNJqnKQrvaXJeBJ4fWjdHd2YdjUjB55E922mXh:7jekyxudaKCKGWEhnt8HS
TLSH
T1987638C7F8A455A4C0AAE33189629293BA717C484F3123DB6B50FF282F76BD46E75704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

448800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

306KB

Virtual Size

874KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

x64_upx_test.exe

SHA256 50a4e2e7a8f825ed8e1b1429a4e28d5dccbb8ef2f5fab473be154e398dd4b336
MD5 e5708d8ab51be3345db6007e68803ba7
SHA1 24b95b72b7c85c1f2aee189368449224c9d2059b
SHA512 78bce9439fb8b79b03ed0ce7f9a73d09006fbcbb765c26a3ce53e0f7e4c4ae88d0fafe7bb084463eefe0f7c6ad8a4d7000ea6ee8f8a9a155792c9c28ffd375d3
SSDEEP 49152:rJSa+Ennnf6E0KrhDcMP6hWML8rKP2SRFDcTxAMYegqFTyJmpIOhsh:N+Enf7frhpOj8rKPBGIqFkm1
TLSH
T178E53338D1BBC1F9FECC7DB0C4A0A727E2620B5B1976AFE93792726D941208E1167D14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10363344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

infected2026100301.7z

2.exe

kernel32

generic

MicrosoftEdgeUpdate_x64_1.exe

kernel32

generic

MicrosoftEdgeUpdate_x64_2.exe

kernel32

generic

x64_A_nolit.exe

kernel32

generic

x64_D_go122.exe

kernel32

generic

x64_E_go122_notiny.exe

kernel32

generic

x64_F_firefox_tls.exe

kernel32

generic

x64_G_noutls.exe

kernel32

generic

x64_upx_test.exe

generic