fab649ba7560aabae90aef41b0b244ae2e2b0db3e0076e135fcaa54a79fdb8d6 | Triage

Sharing

General

Target

fab649ba7560aabae90aef41b0b244ae2e2b0db3e0076e135fcaa54a79fdb8d6
Size

40KB
MD5

415247cc0f627dd49f21f3b1b2589b31
SHA1

d882927b621d1fcd9c48b583927e89372108f10b
SHA256

fab649ba7560aabae90aef41b0b244ae2e2b0db3e0076e135fcaa54a79fdb8d6
SHA512

c53a74562c1c9e3c7433a3984b78cd5a8d861d6b02d854b8129e508cdc9358e3ba5a15887bb8f02fa38a3e864e734e6560fec1c7c13e6ed51394131b139f81f7
SSDEEP

768:x+lXPe7C6gHxbeL82npVKXQXKdb4Qpfq+aJe1mgawzxsUNCub8PCqjIHxATVGuxI:8lXPM8RSI6VD6B4Wy+aJe1mgawzxsBuv

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

fab649ba7560aabae90aef41b0b244ae2e2b0db3e0076e135fcaa54a79fdb8d6
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ