3c8f3538ec3ed271c416e5fb7b0358efe0aec19f0ad05b119d226556c69c0075 | Triage

Sharing

General

Target

3c8f3538ec3ed271c416e5fb7b0358efe0aec19f0ad05b119d226556c69c0075
Size

490KB
MD5

75d59060f6e6b418075137c22bf7362e
SHA1

25d54eea777ec0fb590e763894701ea86dee74e9
SHA256

3c8f3538ec3ed271c416e5fb7b0358efe0aec19f0ad05b119d226556c69c0075
SHA512

5eb3b6d19bdb8437e1c867f2cfbc159555a193128464d35a1bb5784a2fd33bac0d7cf7f2da30dc5f8fbd1736a54cf6952a1e87cfa4fbb6f781a4a29279078c1f
SSDEEP

6144:2ei2bAoA8ZYFmYQHUpTRsMHgpZCN+Sn79l0T6SQwO7DsIFxyb9NY3EKjjRL8RKlD:2ew4kHBg2Nn/k64iDs8yhy3EAvlkzO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3c8f3538ec3ed271c416e5fb7b0358efe0aec19f0ad05b119d226556c69c0075
unpack001/out.upx

Files

3c8f3538ec3ed271c416e5fb7b0358efe0aec19f0ad05b119d226556c69c0075
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 444KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 926KB - Virtual size: 925KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 306KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ