RIW[.]exe | Triage™

General

Target
RIW.exe
Size 138KB
Sample261009-rx86kabe37
SHA256 244ca68900264491030b80a89f2e2989fa3aeb938060baa9e3a2b2cc37d5b780
MD5 febcedcb743762eada992097a9ed3741
SHA1 6f4edfb59e342d6b234965dddaa11ccff8e5c27a
SHA512 0e15f76a0a65a6d9123ce59ddf9f01ac4c018d0f8ede79114fadc34ab87390dd304457fd0702c1ebca9d8b006c399d89052301fb14bf854b64d4bdcf6f435ad7
SSDEEP 3072:rijgzzDbMbJUelGkp5cLsr0UAUDLgMSa1EJz:rUgLbMb0S5cLjUDMMSa1EJz
TLSH
T11DD338E032D89D97FA74537C8585D222263DFAE596139B13D1A0A5730B62FC23DD23CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RIW.exe

SHA256 244ca68900264491030b80a89f2e2989fa3aeb938060baa9e3a2b2cc37d5b780
MD5 febcedcb743762eada992097a9ed3741
SHA1 6f4edfb59e342d6b234965dddaa11ccff8e5c27a
SHA512 0e15f76a0a65a6d9123ce59ddf9f01ac4c018d0f8ede79114fadc34ab87390dd304457fd0702c1ebca9d8b006c399d89052301fb14bf854b64d4bdcf6f435ad7
SSDEEP 3072:rijgzzDbMbJUelGkp5cLsr0UAUDLgMSa1EJz:rUgLbMb0S5cLjUDMMSa1EJz
TLSH
T11DD338E032D89D97FA74537C8585D222263DFAE596139B13D1A0A5730B62FC23DD23CA
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

178512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths