sFX[.]exe | Triage™

General

Target
sFX.exe
Size 294KB
Sample230417-y698jsfh94
SHA256 8a186f546c36a34567b695addfb776f2c2df584535a133fdf3ca699d4ec64e38
MD5 55536247ecd1a051a72d5985c97425f3
SHA1 3a97479623694ba395b86cc64b7e18cc86b39e24
SHA512 d2e6d6a024edd785a92fb27abf1b90619edc98f88e045b242796932f8c4f0c1dd96d5f0e91d0fa5072a1f68c836d8d4893bc3bc2943e4880e62a70ce23276696
SSDEEP 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIm:v6Wq4aaE6KwyF5L0Y2D1PqLg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/out.upx	autoit_exe

File Explorer

sFX.exe

.exe 294KB
out.upx

.exe 634KB

sFX.exe

SHA256 8a186f546c36a34567b695addfb776f2c2df584535a133fdf3ca699d4ec64e38
MD5 55536247ecd1a051a72d5985c97425f3
SHA1 3a97479623694ba395b86cc64b7e18cc86b39e24
SHA512 d2e6d6a024edd785a92fb27abf1b90619edc98f88e045b242796932f8c4f0c1dd96d5f0e91d0fa5072a1f68c836d8d4893bc3bc2943e4880e62a70ce23276696
SSDEEP 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIm:v6Wq4aaE6KwyF5L0Y2D1PqLg
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

757360

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
MD5 d67ea5285c3c56c6fdc8f2a28354bd44
SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
MD5 SHA1 SHA512 SSDEEP