Exodus[.]zip | Triage™

General

Target
Exodus.zip
Size 242KB
Sample261014-w7tabahs7w
SHA256 2aba65a560ecda83455f6ad37a2b8e1de737cfb43949705dd192fb15096152d2
MD5 224aec782f051ab8017e5b894b3cf82f
SHA1 550e52f51b3cc041fcc870074dc0a681a6fe1cab
SHA512 fed3a01197afcc4ea69cff0ca6e34ce6eeade46e70453b4730a75397c1823d35031cd52d67b06fcc3da9501c05b81a23a71d9849f927d5eb6cc49c21bccb0bf9
SSDEEP 6144:uFpnPx++5UgPA7O22nivHR4VJmOWSq8Bipto6fLRBQ0S1:urnPo+kjlR4Hjip+6zy
TLSH
T1E734128DC8E9C8315EF6D0303C9B5A9733B5C1999521B36BB42493489E0AE3E7E643DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Exodus.exe

File Explorer

Exodus.zip

.zip 242KB
Exodus.exe

.exe 1.1MB

Exodus.zip

SHA256 2aba65a560ecda83455f6ad37a2b8e1de737cfb43949705dd192fb15096152d2
MD5 224aec782f051ab8017e5b894b3cf82f
SHA1 550e52f51b3cc041fcc870074dc0a681a6fe1cab
SHA512 fed3a01197afcc4ea69cff0ca6e34ce6eeade46e70453b4730a75397c1823d35031cd52d67b06fcc3da9501c05b81a23a71d9849f927d5eb6cc49c21bccb0bf9
SSDEEP 6144:uFpnPx++5UgPA7O22nivHR4VJmOWSq8Bipto6fLRBQ0S1:urnPo+kjlR4Hjip+6zy
TLSH
T1E734128DC8E9C8315EF6D0303C9B5A9733B5C1999521B36BB42493489E0AE3E7E643DD
MD5 SHA1 SHA512 SSDEEP TLSH

Exodus.exe

IMPHASH 73f461c771aef77ec43d53a0c54f0c8d
SHA256 bd9db280ad4f24a879d8bd1a8d37c18b28de4b12523c4b1e6d224a4370ed55dc
MD5 c59668df723acb991fbc44c4b03fac3e
SHA1 f6f6422e6ae5b19a506416635e6b26e0051fc38e
SHA512 3a492fdd06a12738704debe1e0fe802d063e9e2385534240bdca59c83236608d70242f256e4f38cf17a735c25571e0c287e097f86fcc89c81d88a3c3a93f5782
SSDEEP 12288:HZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGcvPqItNquB:Hcb4M06WpoPrw/vP3f5
TLSH
T1F8357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Exodus.zip

Exodus.exe

ntdll

kernel32

advapi32

crypt32

ws2_32

generic

Sharing

General

Malware Config

Signatures

File Explorer

Exodus.zip

Exodus.exe

ntdll

kernel32

advapi32

crypt32

ws2_32

generic