397ac1b63a88e2f79bb0ae8ba84ef990[.]exe | Triage

Sharing

General

Target

397ac1b63a88e2f79bb0ae8ba84ef990.exe
Size

3.0MB
MD5

397ac1b63a88e2f79bb0ae8ba84ef990
SHA1

34f6871511172a041eb018793896aa63fa0eddf7
SHA256

8d4e14b6dfd7d84a6dbd5ddbc6ba32208dd74338a44377862d9afa04d46d5015
SHA512

06ed021cb3cf8306a54ec0698fc4054a04f0b7d08f05d547e1e74ca117340bc957d0e02cdf2e915f985868d6d93ba21217822277a95640e295f412c401b98bcc
SSDEEP

49152:6GAS/Yy+/O9ccmVVxcTZ4nynw0z6IdsU81tYA8SeY1vABvylLbWBcCsV+AkJXpHw:lH/Yb2ccmdcTZF5HMN8SOvMLUDAkJ5Hw

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

397ac1b63a88e2f79bb0ae8ba84ef990.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 10.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE