trejjner-17-2-0-0-1_1715588582_518401.zip
- SHA256 8a2d7f44cc2802e7ad021c84b2e8c3c2ad04c66d2759e86c6108a932cf9b7ca0
Behavioral task
behavioral1
Sample
trejjner-17-2-0-0-1_1715588582_518401.zip
Resource
win11-20260911-en
windows11-21h2-x64
7 signatures
900 seconds
General
- Target trejjner-17-2-0-0-1_1715588582_518401.zip
- Size 5.2MB
- Sample261022-saffeafw2k
- SHA256 8a2d7f44cc2802e7ad021c84b2e8c3c2ad04c66d2759e86c6108a932cf9b7ca0
- MD5 068177a0bf909e2240c917acefc6a6d5
- SHA1 171187bf35433cbbb876064cb4fbec7d304b92f5
- SHA512 d9f3ef19cb1b3755dedc6c63beef117191896940c0d7924fd037396461a13bab35edcb3c1b8155dafce2c69d8be498d4eb04ea7ca9463fac794bc8d300e75aeb
- SSDEEP 98304:Uifoe7IeR3bkRcuuR3/bCqtOGRB8iGeHIkYvkKji9R:Jff7ZR3WcuuR9xhHI/vkK29R
- TLSH T1C9463315E21CDEBAF725C6364FBC3F1994D63068C2A00D92F7E954F562739241AA02BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Metro Exodus (+17) {mul0}.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Metro Exodus (+17) {mul0}.exe unpack002/out.upx
File Explorer
-
trejjner-17-2-0-0-1_1715588582_518401.zip.zip 5.2MB
-
Metro Exodus (+17) {mul0}.exe.exe 5.4MB
-
out.upx.exe 18.7MB
Metro Exodus (+17) {mul0}.exe
- SHA256 a23f67f48194147b07ae220952bb76c36944c8c4b4bb3c27473e713a578a9629
- MD5 fd0ec1de22e790c53309a43f49d54ae4
- SHA1 ddea36101a371e5e611d62339a074bf4d21d1fcb
- SHA512 682653632c5aaa6f7df4c415de6f1a706fcb76159e47fc102ca9d8c713dcbf91bf65599d741d3248fcd07ab079a87b5c8085356ea8955b21eba388bde9986ccd
- SSDEEP 98304:h2fDp9m6R7sXXc69fAnF2IVD0qeilr6A6rEJp27IudM83Y1jj:RwYvkFl0zs6FrEp27hl3Yd
- TLSH T1F6463343F114AB73D6183A748F51CBF4A305FD688A865B5B93F4FA4B3E341D1898A0B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20186080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
14.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
188KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 99a30610226a71c1da17e3f9148635e8264caa4d15a6155b9925559b3213525a
- MD5 baf0c7b0f2653e3de97f5feaa47cec0a
- SHA1 4f248d082bdf433363aa0845718894b706518d01
- SHA512 0e40b3b4dc599a19323614360d8aaf9544486734483d3b475fafbb821f7ed53b344fb2f46727089db01b0fb698500a1eb708e8a8e831f25d6accf4ac3c0f76d3
- SSDEEP 98304:zcgFIkE8Ps2IEBTzOPlupsch8KbOt+X3zTwjXm135ssfFWf1JpDwISpF4dJg47//:zcgNtk2BZpschxO+X3IU5WBcdpF47g
- TLSH T1A3175A9637A48118D17EC17A96578B60AA333C740FF58DEF1D8072A41F326C19E3BEA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9149456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
8.8MB
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
789KB
Virtual Size
788KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
404KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
121B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
332KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
415KB
Virtual Size
414KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ