Metro_Exodus_17_mul0.rar
- SHA256 b62c9701d02bf23f567e7a3ffbbdc6fb646995c3c83689096399bd50d01d4522
General
- Target Metro_Exodus_17_mul0.rar
- Size 5.2MB
- Sample261022-2vhwpsyt3q
- SHA256 b62c9701d02bf23f567e7a3ffbbdc6fb646995c3c83689096399bd50d01d4522
- MD5 b4bc7fae614a265f3d011d5a103ce2eb
- SHA1 5c16d2e5d77281010ccdba7f7c3ff2abc82b99e1
- SHA512 ea185b47ec2dc9a1bf80df04c50241b9b7c0bb0f347d8349713d52a7334e4d92a1261af8eff082bf948b0b30283df1e85b7870b221d1c242f5013d7ccfa5cfcf
- SSDEEP 98304:7KWeEAD+SpVC9UsiFEswnf5mHnKgZX77imPwX4h4MSX7wRiueIOuCBAmBYU:aEAaI0+siFNwh4nZZrOD4hhSWnCBAmBd
- TLSH T1CC46330D9318F69007B865A5794BD90319D58EF786D1DD82A631AF20843F39BF3B2BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Metro Exodus (+17) {mul0}.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Metro Exodus (+17) {mul0}.exe unpack002/out.upx
File Explorer
-
Metro_Exodus_17_mul0.rar.rar 5.2MB
-
Metro Exodus (+17) {mul0}.exe.exe 5.4MB
-
out.upx.exe 18.3MB
Metro Exodus (+17) {mul0}.exe
- SHA256 a2cd595c5a01ad7491f956f65605844feb58c9470813f96a8f4426355be28290
- MD5 9f78a3f481dfe7036aff2a585639ab8c
- SHA1 d98e0c9de386fc41a6a69cede67a46d720075f81
- SHA512 e9c80ecab70e3f89921cf464fad524bde6d914ae00a0f2d1e387b0ce14128a45e01360a092e1a139c13a1e3fc6e0e5c12a1cdd94f05dd71029323a75cc6c1b01
- SSDEEP 98304:kSZXXaTEds+6y2PPJ/EJqBV7NWipqiCYH9ALxdNaCvwVUcgkO:Btdr6RPNEJqnNwiCq4aCvwNT
- TLSH T10A463351A1805672C13D6138AE89EDF49238ADF82C9A2E1793B0F9CB7E7B4D11F8D153
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19680624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
Name
UPX0
Size
Virtual Size
13.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
188KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 2d6a1c2a56f95e207451878a0aaff279ded709f9f941da5977720bee66a1e0e0
- MD5 4224f8cc1cacfaec5e428dec5a7dff76
- SHA1 74a08ba3a5261318b8dfb66429bc90c8a064b451
- SHA512 d4d02c2698968cd4d775cb06ab135b80c9f4a62053d9eab9ad1c502cd25baa970e536018f011389a93540c005a8d6e227b685b7372ad45a49c6b9c29ba48cad9
- SSDEEP 98304:rp4K4WPCuRe1NOkdz3MEivf8Kb3tem3zTwO1m135ssfFWf1JpDwHzIzr7BRETNxj:rp4Ktz37rvfxhem3YZ5WBcMVGT3g
- TLSH T153177B6B35A88128C03EC13A85A78F60EA337CB40B75C1EF11D477691F766C19E3E6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9149456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
8.8MB
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
789KB
Virtual Size
788KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
404KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
121B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
415KB
Virtual Size
414KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ