f1f5bc4e7b8c618db3253016eac65d88f20f3f8db06acf1b3437c9be91c6ef63

Sharing

Copy URL Twitter E-mail

General

Target
f1f5bc4e7b8c618db3253016eac65d88f20f3f8db06acf1b3437c9be91c6ef63
Size 556KB
Sample221204-elljxaec83
SHA256 f1f5bc4e7b8c618db3253016eac65d88f20f3f8db06acf1b3437c9be91c6ef63
MD5 362abb7bc844b49273a64ade1d3e29df
SHA1 dc09d13368217e342d3a2f479be3e26098b55e5c
SHA512 57505a788f42d611e31adf6c87795e8d9a0bdb97cbc3adb6d11de734565b0b4c03387b431a6751008efb49bfd83825725e6b18d2281b7908eef45ae08fff2a0f
SSDEEP 12288:OGosTxSzpDq5VNYdyOshT5l4/86CaIhvPfNMIM1P27QwMMT6:OGosTxSEXzOV/UaIBNLMp20wMMT6
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

f1f5bc4e7b8c618db3253016eac65d88f20f3f8db06acf1b3437c9be91c6ef63

.exe 556KB
out.upx

.exe 1.1MB

f1f5bc4e7b8c618db3253016eac65d88f20f3f8db06acf1b3437c9be91c6ef63

SHA256 f1f5bc4e7b8c618db3253016eac65d88f20f3f8db06acf1b3437c9be91c6ef63
MD5 362abb7bc844b49273a64ade1d3e29df
SHA1 dc09d13368217e342d3a2f479be3e26098b55e5c
SHA512 57505a788f42d611e31adf6c87795e8d9a0bdb97cbc3adb6d11de734565b0b4c03387b431a6751008efb49bfd83825725e6b18d2281b7908eef45ae08fff2a0f
SSDEEP 12288:OGosTxSzpDq5VNYdyOshT5l4/86CaIhvPfNMIM1P27QwMMT6:OGosTxSEXzOV/UaIBNLMp20wMMT6
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

74:4e:3b:de:fc:95:6f:17:15:b3:bb:0f:86:9b:20:ff:89:77:12:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

1151296

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 06bd002223764881b9ab77a36bb146d4687673776b215d17b0e9482d61e989b0
MD5 59bc98e09724f37b41f342c57639a70e
SHA1 1dc7637247f937ab0bb07eaf7741ca7fbd2db24b
SHA512 cd0f9f068bef36af39b4a476f2c526adf6cfdfa697cfafd907ee93970b66e86969677e7af39ca862e5d594a2b231ba586ba3db164e97031df1fdbb9ee2a4ef6b
SSDEEP 12288:ZV1T3K2gsmuEzulqJ9gifEBeVcNQAlQcxC8H98bQ246UzlST1MMTaIqeMFUr:1TK29mnzuCgKKblf8biVoT1MMTxqtFU
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

794210

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

783KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

219KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ