1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8

General

Target
1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8
Size 491KB
Sample220607-ez3eksghb9
SHA256 1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8
MD5 76c487459d38c2801be5fdba0587912c
SHA1 428b648e9506dd3a2dc644797756ed4ea39a0338
SHA512 85ede1f60c4ceac485e55176b7ea7bf3cd9bfe95e8745e97cf8825e3c7efcf70c32b2af85d4d96221919a0e2c8a5dd44009696707d5454a8f0ff5ef52db96808
SSDEEP 3072:EfJvbjluG3rpsPdqW2bKOpqGHQwAdPUmUuRpMoGnBqhCWrJeRGlSWVlLsr:EfJjj8G3elAbK+qelsEloGnY8WrJ2/j
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8

.exe 491KB
out.upx

.exe 580KB

1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8

SHA256 1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8
MD5 76c487459d38c2801be5fdba0587912c
SHA1 428b648e9506dd3a2dc644797756ed4ea39a0338
SHA512 85ede1f60c4ceac485e55176b7ea7bf3cd9bfe95e8745e97cf8825e3c7efcf70c32b2af85d4d96221919a0e2c8a5dd44009696707d5454a8f0ff5ef52db96808
SSDEEP 3072:EfJvbjluG3rpsPdqW2bKOpqGHQwAdPUmUuRpMoGnBqhCWrJeRGlSWVlLsr:EfJjj8G3elAbK+qelsEloGnY8WrJ2/j
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

624384

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 615c712bc783fe9110b76ff32a784a88a5c8381cbccc37730a14a77a4aec9673
MD5 4581853bf333b0b6bc8d0d547d6d7bfa
SHA1 ef66e40e0d5db7ed520f86cd3fbfd931433b5080
SHA512 66d8db8a985db55aae0713cecb6626203fb356acb1dc2d9085c791f1083c0297b09e9b0a78a815187ea18cc403ec7a2b8d0a6370441bb7a80ed4462d9df10c17
SSDEEP 3072:4fk14gQEriyszzvk8ltF+mgQ43e0WnLXWVlLsrph2jqAnAndcDeFqLPm2wADBxRN:4fU4wsNg6AVeLXjOjO+moBAZXUBgsnL
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

8817

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

188B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

476KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8

out.upx