ffef0b477e362cfc3f1be6908c8540b700e6397854db8e2b293b8091481b66d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffef0b477e362cfc3f1be6908c8540b700e6397854db8e2b293b8091481b66d3
Size

63KB
MD5

facd50eb960264857c6e5ff9739178a6
SHA1

25d0174971b9a065a6a008b5529e1ae9afdf0a54
SHA256

ffef0b477e362cfc3f1be6908c8540b700e6397854db8e2b293b8091481b66d3
SHA512

4e2797dbaa63824d605d28472ca7b1be1ef3a9bca6755094030fb49007e99e6bee53cbffa65b3a2c38207c3d6311efb69fef3014cb825f95b8a73ebceb710545
SSDEEP

768:5tEduH2bZHwbOdI+o15Osv62ApMzsqp7ZCGnbkdROF0xbvBsKw2s0n4h5hYKlOIE:D21Hza+85OEjoqJZCcTF8bv6r0n4hzs9

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

ffef0b477e362cfc3f1be6908c8540b700e6397854db8e2b293b8091481b66d3
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ