Nouveau_Archive_WinRAR_2[.]zip

resource	yara_rule
static1/unpack002/Korsakoff GUI.exe	ConfuserEx

resource
unpack002/Korsakoff GUI.exe

Nouveau_Archive_WinRAR_2.zip

SHA256 300dad43a65810d55185c1cd80edb2ae2d47ab41ba4391a7e7fa5f0e1d439b0a
MD5 74a614cfbc0c91e6bdf7883ee64a6f5e
SHA1 5745c9461cb50a71db736abe6c4298fe9938b425
SHA512 e26c15c4b125c0ad25a61f417ec77171568f0c28f48c60c8253c38a6b1d8e0d7d3b7f69ae10ac2469bef8d43e43db1c00304874e8b01dc47c3625870423ca7ca
SSDEEP 49152:qwy2Dt5nlH/JL4ysPw/8CgBQasL9j9qhM1/44u:SGPlsi8CgB+l9qhMTu
TLSH
T1F9B533BB4C21766A874CC73A43A8DD7A1CA6318FCB4D44D81E948714DA04CA7ADB77E3
MD5 SHA1 SHA512 SSDEEP TLSH

Nouveau Archive WinRAR.rar

SHA256 946fb76d162e7b3e4f93ab9e30bbc21e36bbfa8a5f1192bdfbf68af50252eca3
MD5 d85abea9878a912bf1f3c86118678b0c
SHA1 df477ad0df88b8ff00dfd541d572caf114bf71e6
SHA512 128d10468d9b504e0606a8089eb209cdac492aa0e26aa09a0f74f0c23b8a759a8c4b07235c43121ef0047629fcaae96e39969a796784528f2709fabd4760553d
SSDEEP 49152:3wqEDT5nTNr3L44szI/UAoFCswBRVLeT4zjIiE:HkFxW6UAoF0pLeT4bE
TLSH
T117B533BB4C21B66A874CC73A43A8DD7A1C66318FCB8D44D41E948714DA04CA7ADB77E3
MD5 SHA1 SHA512 SSDEEP TLSH

Default.ttf

SHA256 fe204a8ee8802b311f8e93550833669c204155353d527b9ee5c991b46ba78c01
MD5 d221140abbf98d4bf2c97f90bdca3bac
SHA1 e601cb6724e5f684cfc9fa88cac071d34ad68f45
SHA512 d25c646bafd8b4e009d61fec501a487b65c649aa6adbfb9f3fa122b54a79dc20fce4ab0210e12d2cdf31162bc6eeceb9ff18456786e6c89380ca93d8620f2e88
SSDEEP 768:WzQTe1+BXuZlScJ4XoRb+nDHJ6qT6ixyN0ZBopZfFo:0D+BXeScYoRb+LgqT66yNABoH9o
TLSH
T181037D0BF7C6CB6DE3138F384E60736AE5A4FA3E5B1B835782045D35B9862944C4DA98
MD5 SHA1 SHA512 SSDEEP TLSH

Keycheck.ttf

SHA256 f779e2d561278bf8b60e4177e39d93b20b403883b42636c896110949a00c029e
MD5 5ecd6439ecc182a512dbc84b54e3f366
SHA1 bc8fbffdd749e96c728e77ddb615994d4740d678
SHA512 5ac3d6213bf4bd31632c9fb4e5e052fa5d0d27902a2a396b81ce51ea36aeee3b9727d2873e18b986057336eb39568e473a915040dae8cae8f6afc239d73d3f5e
SSDEEP 768:3B0VjxNe88+Mr1V1GaVYI0bmJOeHamVwlbZb3crXu8zYNH+bDHCXB5Oefg1Lob:eHNeprxfOeHx+hQ50+bGRMeh
TLSH
T1AC03E825BBB6F20080750EBA5CF446727B4BD3152DB38B5E5A6B9ED1B93B0C3BD44608
MD5 SHA1 SHA512 SSDEEP TLSH

Korsakoff GUI.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7de2cea01011401058b4f54580befae1d07fb46bf0698b42328bb1cba2ef8dad
MD5 a4e2e16dfa42f160cc55892aaa68287e
SHA1 e58480d4c09e7b652b3bde2639a1382cbf4d9146
SHA512 d8d40841140fa617d7188288a6067aeb44e49397b8153dad1889e1ae52a27edae2233b5c3e7c80331f7336d4c21d7c6448fa12c2964c6d3bb2bc91022fed6a6a
SSDEEP 49152:TG23OcQc2f7Qh4g1RAtgtMR4X1N+S+wt0K2bnUUm3PcYf6GQwXo42G23OcQcrGwH:TG2+c12DQhPRAcu4+SVeGHv6+Xo42G27
TLSH
T1F2D51242BF408AD2C4148A7CD85B93252771BD97DA83834B2298BBAF78B36D0754F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2616078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Nouveau_Archive_WinRAR_2.zip

Nouveau Archive WinRAR.rar

Default.ttf

Keycheck.ttf

Korsakoff GUI.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Nouveau_Archive_WinRAR_2.zip

Nouveau Archive WinRAR.rar

Default.ttf

Keycheck.ttf

Korsakoff GUI.exe

mscoree

dotnet