011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82

General

Target
011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82
Size 4.1MB
Sample220512-ngjn7acee6
SHA256 011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82
MD5 92c314b7692cb2b64512750ad7b3d1b4
SHA1 a9a80722656e7a40fac99cc7eca2956e234e70c2
SHA512 5bb574b1651d4513b3c1e472861ec8b5ef12decab195affa0d5fa7ce4e8e4fa7c4fb0f79aad0676adc31f1fbac6a3eae3a2eb798137e8357e81cd700f15c2668
SSDEEP 98304:X6jSrREHZ3lNmzNdI76iA0klXUOnHtlqdn7RrD3t9Y5:geElGzNdEcTNlqfrbt9Y5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82

.exe 4.1MB
out.upx

.exe 7.5MB

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82

SHA256 011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82
MD5 92c314b7692cb2b64512750ad7b3d1b4
SHA1 a9a80722656e7a40fac99cc7eca2956e234e70c2
SHA512 5bb574b1651d4513b3c1e472861ec8b5ef12decab195affa0d5fa7ce4e8e4fa7c4fb0f79aad0676adc31f1fbac6a3eae3a2eb798137e8357e81cd700f15c2668
SSDEEP 98304:X6jSrREHZ3lNmzNdI76iA0klXUOnHtlqdn7RrD3t9Y5:geElGzNdEcTNlqfrbt9Y5
MD5 SHA1 SHA512 SSDEEP

windows x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

8410784

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 c606d4203dc8251b16020abc6d89de04d60e9e078bbfe128eb3f067a3242c207
MD5 11c2f0f347de17469aa377207669742d
SHA1 da9ff0a4190eeda9755e668feedc68fd3e3d492b
SHA512 bc2f09cd5b28e10f7889d1b02f55703096f9dfb143c0c72ee5e3ae573e358f48eac9dff6b20c81af5c4564f9257c3c68458ecfd2e5859009dc09fea2f8270f17
SSDEEP 98304:Fk0icH+bMyTx8MEDSIrGE1AbZ2v1qjK4rIo3LW6lkoElJ:FeVtENybZMyHW6z0
MD5 SHA1 SHA512 SSDEEP

windows x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

412224

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

329KB

Virtual Size

831KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82

out.upx