ScoobyLoader_0.zip
- SHA256 54a9dc41b3aee43df7b729cdac5f25b284094f8225b2e0b016f7b1f21e77cf18
General
- Target ScoobyLoader_0.zip
- Size 2.8MB
- Sample261022-vreasaws7l
- SHA256 54a9dc41b3aee43df7b729cdac5f25b284094f8225b2e0b016f7b1f21e77cf18
- MD5 8fe1caeaa9b9d875f6446186dcd3b90e
- SHA1 2d5a61a068fd9fa20f22f92f52ea8f4498d16ffc
- SHA512 650705bbc23f955444f5c48aa0d016be713854e0d074c06e05b833f71f759bb799bfc83a2f4ef333d3cdb01f9a7518799d16f3f693946ce5d3982522bf0aa88e
- SSDEEP 49152:vcTm/QWF2u952ghN0fcLOREdF7Z99hsSBaY1acfK5mn51P9rwQOI:vVIWZ1eREdF7NmSp1PAS51PRwQOI
- TLSH T1A2D533BF61563462498D36D50CCFEFDB726AF246AAC7AE4450430A109ACECCAF235F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ScoobyLoader.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ScoobyLoader.exe unpack002/out.upx
File Explorer
-
ScoobyLoader_0.zip.zip 2.8MB
-
ScoobyLoader.exe.exe 2.9MB
-
out.upx.exe 8.7MB
-
_README.txt2KB
ScoobyLoader.exe
- SHA256 ed73c44cc43e32537a50daa3f2a140e92496d23e0d29854210e4ad4cb623b00e
- MD5 80c35e2f2eab119b20bd16a846c38d86
- SHA1 63612e9576213e106225380dbaff41496cc72fba
- SHA512 08844d3d42ea26a881c5907251704c12f023b9ca628209cc3ff065d5c892d982d912121fd98137416a4fad8c9a9e9eb81bb2b111cd5a8a8dc240d36adbbaf474
- SSDEEP 49152:7tkL1nFk16VmQTqsQix5PQ1EFzBG5sEjLpmtXGs5cZgXXt3pEY9Gh9lPyXhDvvCN:7tkLpFl/TqsQktiEFzBjELpmo4cZgX/Q
- TLSH T176E533EF79F8052FED18B1BE352959B2640366344CC7480AA58989D31EBDB6345F8CBC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9339120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=35207,
count=10, id=260, version=35207,
count=41, id=261, version=35207,
count=6, id=259, version=35207,
count=8, id=257, version=35207,
count=3, id=260, version=35222,
count=1, id=262, version=35222,
count=43, id=257, version=35222,
count=837, id=1, productName=Unmarked objects,
count=93, id=260, version=35215,
count=55, productName=Unmarked objects (old),
count=1, id=261, version=35228,
count=92, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=4, id=151,
count=1, id=258, version=35228,
out.upx
- SHA256 e598f8cc74e0697a1e1548e66e63b77373d3cbaabff06e2eb6445900417e44da
- MD5 67c0f2b841ddb25c9e84c25f33910199
- SHA1 9e7fdda7a31c0f3c374aa18f4dd4f43024ec9bb2
- SHA512 a4bdbe428e72fdd807ea1e67507e4cc5d20bca3df194b3d5536765d0754c67e4f33e380fc8f37c326b18868227ab2c6f0483617e63989ee78b7ba6273a9b867f
- SSDEEP 196608:eHH1b6PjJawdEzxjYdQsxBTCiyc7iEp2yc7CU2ERGKSOcNU1iyc7iEp2yc7CU2E9:eH1I9XdEzWdQyBTQRRhDKo
- TLSH T12296BF17E36118ABC1B2C13884124723FAB5781F477AD3EF71B19A2D6FA64D08E76B50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2700892
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ScoobyLoaderCompiledVersion
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
705KB
Virtual Size
705KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
107KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=35207,
count=10, id=260, version=35207,
count=41, id=261, version=35207,
count=6, id=259, version=35207,
count=8, id=257, version=35207,
count=3, id=260, version=35222,
count=1, id=262, version=35222,
count=43, id=257, version=35222,
count=837, id=1, productName=Unmarked objects,
count=93, id=260, version=35215,
count=55, productName=Unmarked objects (old),
count=1, id=261, version=35228,
count=92, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=4, id=151,
count=1, id=258, version=35228,
_README.txt
- SHA256 8bd9987ac5fa457c167792fd1fb24fe83c82c8c9f5a8b28522be7bb28cbc6e9d
- MD5 96745bdb5fb2786d57e89f2a48627e82
- SHA1 20d2b3be628c364939d039e2262603261a00c646
- SHA512 48637752545e074411dc08c2becfd80a407be2d1ccd0dad3d12df7529104480401d4f9bfb4988e790f1e48d969dd7061e0741e5732c32fd8833d97376ffc62ea
- TLSH T1B3413F5FEE9E33328B524289785E32C9E772B719A392205C94A9006C95B771E46B31E3
- MD5 SHA1 SHA512 TLSH