Loader(1)[.]zip | Triage™

General

Target
Loader(1).zip
Size 2.3MB
Sample261113-vsdewayv6k
SHA256 32cb6a6b46aadff7909b517cd84b2d6c6913c98da0adb25f928c710c23a49a92
MD5 3f10d04eab9247faf51e6e2ba56ac0a0
SHA1 a1187fefa78dccf37e1d79e0889b2255c6ca956b
SHA512 d2e4c0223a56587ca162628bec100441280db74a16468e8197b2f2fffe5b1705f7c845d8125999cdb387bf6bd2a33a290e0231e29fe172b910bd14b88960b621
SSDEEP 49152:uxPk6SIQaw1trfO2JLlNJKpdKQF3Y78F5RRG6gN2HXf+XC133DLp:O7e9fzNJ2FIgOgXfZHDF
TLSH
T10CB533B63493BF0F322A43E74182DAA36E76CC5AE8DD9A7FED1DB19116C324E4407065
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Loader.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Loader.exe

File Explorer

Loader(1).zip

.zip 2.3MB
Loader.exe

.exe 2.3MB

Loader(1).zip

SHA256 32cb6a6b46aadff7909b517cd84b2d6c6913c98da0adb25f928c710c23a49a92
MD5 3f10d04eab9247faf51e6e2ba56ac0a0
SHA1 a1187fefa78dccf37e1d79e0889b2255c6ca956b
SHA512 d2e4c0223a56587ca162628bec100441280db74a16468e8197b2f2fffe5b1705f7c845d8125999cdb387bf6bd2a33a290e0231e29fe172b910bd14b88960b621
SSDEEP 49152:uxPk6SIQaw1trfO2JLlNJKpdKQF3Y78F5RRG6gN2HXf+XC133DLp:O7e9fzNJ2FIgOgXfZHDF
TLSH
T10CB533B63493BF0F322A43E74182DAA36E76CC5AE8DD9A7FED1DB19116C324E4407065
MD5 SHA1 SHA512 SSDEEP TLSH

Password

9491

Loader.exe

SHA256 85ea817ce35270bcabe9d7a7d2a28d2f6b6a864a483f448528257acf0476ed23
MD5 5059d73b7920f567db97f19cba46fdbe
SHA1 fb953453beb3798ffbe08e42656d3caa44c99642
SHA512 1aa4bdae06e5dc79e3329f37dab49077877c6e4bd07b1c8d99dbad8ee5aecae189c208c012aaa530f61951f67c0a06bf40756d8bc98b90c24821322c0777ca19
SSDEEP 49152:T2vmwb57HmHKVaE1jmD6L0UNqIdFQJ15/NHNEljqReqV5:C+wb5E6aE/L0yq2FQp/NH+j8
TLSH
T1A5B5331D0825506DE28DEEFE75346DC423F23163A59DECBDB8EA072B31F25E5ADA2440
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6540384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Resubmissions

Sharing