Hemera[.]zip | Triage™

General

Target
Hemera.zip
Size 3.4MB
Sample261018-r2sdlsbd73
SHA256 337544e5662ad22140a393d08f22b12964908585838aa359efa4cab889561540
MD5 aff50f9a1f5a65cd160acfb05342a7b0
SHA1 6b9af5c4542881b09a4843a32bb68ddf8764fb77
SHA512 2d5b7e5b57522f052bf5bfee83b2db5a3d8e7046e9370dd5faad7ba54e02e5d7f96d1d266e86df1426c53320b58dd2e7c79264a81cc35bc48f029b144d15ec1f
SSDEEP 98304:6EDhL0KG4WnlmryUJUxc/JxCNUEygpHtQnFLBXM:NDt0KG4Wnlm6xC/3CR+nBBXM
TLSH
T1E2F533D2B86F2425D6CD9D65DE09BCB6C95C7C84B1ACBBA120F699905FC890CF00B7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Hemera.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Hemera.exe

File Explorer

Hemera.zip

.zip 3.4MB
Hemera.exe

.exe 3.4MB
PASSWORD: 9243

14B
instruction.txt

651B

Hemera.zip

SHA256 337544e5662ad22140a393d08f22b12964908585838aa359efa4cab889561540
MD5 aff50f9a1f5a65cd160acfb05342a7b0
SHA1 6b9af5c4542881b09a4843a32bb68ddf8764fb77
SHA512 2d5b7e5b57522f052bf5bfee83b2db5a3d8e7046e9370dd5faad7ba54e02e5d7f96d1d266e86df1426c53320b58dd2e7c79264a81cc35bc48f029b144d15ec1f
SSDEEP 98304:6EDhL0KG4WnlmryUJUxc/JxCNUEygpHtQnFLBXM:NDt0KG4Wnlm6xC/3CR+nBBXM
TLSH
T1E2F533D2B86F2425D6CD9D65DE09BCB6C95C7C84B1ACBBA120F699905FC890CF00B7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Password

9243

Hemera.exe

SHA256 b6e78481727d39d8743957a370e33049307da73d76c77ebd7704300161c9e2a6
MD5 6011ca5e4e9274f31fcbc2d856cd3ec9
SHA1 20b7150136a72efc443e8ecfaad8abc5e36e2eb0
SHA512 6ee0bceb25b6ec54d8832eb4fc1945b5d8c0cd583c12d405d423cbf50690d15cd49c98b33c8cd18ae8f60ce90df5346c289c89a51cbb971efc631e0286737b32
SSDEEP 98304:oeKIn7GruZ59d7x+AS5F1P09cudcgeiHXq3ogFbX:oe79DkJMvdcaaYgt
TLSH
T16EF533490FD08836E76BE03E550F0246355546CE316AC7D280F960CBB6EBEB73B1A939
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12922512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Hemera.zip

Hemera.exe

generic

PASSWORD: 9243

instruction.txt