ddfa7bb73b14864223693daf79fcc30d23495ffcdffbd5f064bcd19e06c1278f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddfa7bb73b14864223693daf79fcc30d23495ffcdffbd5f064bcd19e06c1278f
Size

2.8MB
MD5

c9e73002488fc9f2d4f0b7e6af0779d0
SHA1

94cdda57933dbb91cb88a0d39a655641db06044b
SHA256

ddfa7bb73b14864223693daf79fcc30d23495ffcdffbd5f064bcd19e06c1278f
SHA512

a5e921efbd1a308c604e3aa7fa3e6baa4305d07aad8ddb687940324f96ac87c3a9fcda81b8cf629ba7850ff24c5e825ed59ec7f32a855b2b7934cec78aa4c43d
SSDEEP

49152:40qh0r0q2wf02GztvGwDws0q40q0qC0FwwRZtFwoGwYwz0qm0S0qC0mR2wqtGwQj:40qh0r0q2wf02GzMwDws0q40q0qC0Fw2

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

ddfa7bb73b14864223693daf79fcc30d23495ffcdffbd5f064bcd19e06c1278f
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE