2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6

General

Target
2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6
Size 8.8MB
Sample261011-2tf1qaaf53
SHA256 2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6
MD5 dff427065104edda3984b2d29f390fd7
SHA1 cba509b3c2cc72158fd402f630a9187f40b12711
SHA512 42be9b4e23fcaa599424a911f12608e136282514a0c7b4e0a334bb75b8e1f240ac4db5c1f5170e3514bdbc40fdfbb9f1d7386245a09aae4ae93a074c6efc0185
SSDEEP 196608:cTUcsWBLcDRYM047stij8N13jaFM2XeM7VRnE4qxK3OkHPRr7:cTf3+YM04W3jEE4q+
TLSH
T124966C10E341D22BF9E310F2D6BE56AE69286730670454C7E3C45EEE9B756E1BE3120B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6

File Explorer

2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6

.exe 8.8MB

2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6

SHA256 2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6
MD5 dff427065104edda3984b2d29f390fd7
SHA1 cba509b3c2cc72158fd402f630a9187f40b12711
SHA512 42be9b4e23fcaa599424a911f12608e136282514a0c7b4e0a334bb75b8e1f240ac4db5c1f5170e3514bdbc40fdfbb9f1d7386245a09aae4ae93a074c6efc0185
SSDEEP 196608:cTUcsWBLcDRYM047stij8N13jaFM2XeM7VRnE4qxK3OkHPRr7:cTf3+YM04W3jEE4q+
TLSH
T124966C10E341D22BF9E310F2D6BE56AE69286730670454C7E3C45EEE9B756E1BE3120B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4400316

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=4, id=150, version=20413,

count=72, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=137, version=30729,

count=24, id=131, productName=VS2008 build 21022, version=21022,

count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=3, id=5, version=8447,

count=299, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=28, version=8830,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=6, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=292, id=1, productName=Unmarked objects,

count=23, id=123, productName=VS2005 build 50727, version=50727,

count=231, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

Sharing

General

Malware Config

Signatures

File Explorer

2ecfb16d27f9a8c499847be492e63ec3bfb940b2f4a36e9bdfae6e6840ac0cc6

generic