Clip1[.]exe | Triage

General

Target

Clip1.exe
Size

7.7MB
MD5

fa0e319484845c1333e5c1e621659027
SHA1

16c33976ef8a5aa1114f2bef9feea5007fa7491e
SHA256

d3d00022e02c57c638d7738e661be715aa74866d8b7495e74b72e0c0f75695dd
SHA512

a9769f0568ea6a05303e2eed6c93b7fab2dda8e9ae6d7d398270b0ef5c9b74884e84842c7b9566f38f772a06eee3a40609f8b412ff96544435a0c852ddb3ebed
SSDEEP

196608:zLBJsvAF7+ftEtuzyeXprQ9z2y6EZaAF5XfpXXIBQQ:zLB+vA9ytEtIJXpGzJzQMfpnIB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

Clip1.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 7.7MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 972KB - Virtual size: 971KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

#%Y&WERG
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

#%Y&WERG
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

#%Y&WERG
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.6MB

UPX1 Size: 7.7MB - Virtual size: 7.7MB

UPX2 Size: 512B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 972KB - Virtual size: 971KB

.rdata Size: 194KB - Virtual size: 193KB

.data Size: 60KB - Virtual size: 67KB

.pdata Size: 14KB - Virtual size: 13KB

_RDATA Size: 512B - Virtual size: 244B

#%Y&WERG Size: 4.2MB - Virtual size: 4.2MB

#%Y&WERG Size: 2KB - Virtual size: 1KB

#%Y&WERG Size: 4.9MB - Virtual size: 4.9MB

UPX0
Size: - Virtual size: 2.6MB

UPX1
Size: 7.7MB - Virtual size: 7.7MB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 972KB - Virtual size: 971KB

.rdata
Size: 194KB - Virtual size: 193KB

.data
Size: 60KB - Virtual size: 67KB

.pdata
Size: 14KB - Virtual size: 13KB

_RDATA
Size: 512B - Virtual size: 244B

#%Y&WERG
Size: 4.2MB - Virtual size: 4.2MB

#%Y&WERG
Size: 2KB - Virtual size: 1KB

#%Y&WERG
Size: 4.9MB - Virtual size: 4.9MB