49c60aa42a90076fa32452f1aecb35bbb0dcdddff3ca9bb91345f564f8103da3

General

Target

49c60aa42a90076fa32452f1aecb35bbb0dcdddff3ca9bb91345f564f8103da3
Size

5.2MB
MD5

8d20e2ebf649903e273f658464db78cd
SHA1

1fe0f96972f80a12efbbdca9575cad6ec70793da
SHA256

49c60aa42a90076fa32452f1aecb35bbb0dcdddff3ca9bb91345f564f8103da3
SHA512

082f512541c454d5b081c3fcc9b729593f599de685c3720f1313277bcbcef6504125f925191dfbc9a7668c150cf2a718a356fdbd977c687cf8ea32e642b0ed5a
SSDEEP

98304:Wwrgl8WegMdxzuMSZqDeSkVi3F65VxZZzH6AV0IRdE8x0p3g0mrxNyqxddYna:XrY8nRzzMZSeSkU3FEHZZzHva8xSQZfv

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

49c60aa42a90076fa32452f1aecb35bbb0dcdddff3ca9bb91345f564f8103da3
.exe windows:4 windows x86

Code Sign

5d:99:a9:89:98:cd:e8:55:b6:3a:86:05:58:13:c7:d9
Certificate

Issuer

CN=余盛立

Not Before

13/08/2023, 17:22

Not After

31/12/2039, 23:59

Subject

CN=余盛立

9a:3f:d4:20:bf:09:38:75:10:62:68:ed:5a:44:61:5a:fe:fe:26:05
Signer

Actual PE Digest

9a:3f:d4:20:bf:09:38:75:10:62:68:ed:5a:44:61:5a:fe:fe:26:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 8.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 872KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

5d:99:a9:89:98:cd:e8:55:b6:3a:86:05:58:13:c7:d9Certificate

9a:3f:d4:20:bf:09:38:75:10:62:68:ed:5a:44:61:5a:fe:fe:26:05Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 8.7MB

UPX1 Size: 5.1MB - Virtual size: 5.1MB

.rsrc Size: 125KB - Virtual size: 128KB

Headers

File Characteristics

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 11.1MB - Virtual size: 11.1MB

.data Size: 872KB - Virtual size: 1.3MB

.rsrc Size: 128KB - Virtual size: 124KB

5d:99:a9:89:98:cd:e8:55:b6:3a:86:05:58:13:c7:d9
Certificate

9a:3f:d4:20:bf:09:38:75:10:62:68:ed:5a:44:61:5a:fe:fe:26:05
Signer

UPX0
Size: - Virtual size: 8.7MB

UPX1
Size: 5.1MB - Virtual size: 5.1MB

.rsrc
Size: 125KB - Virtual size: 128KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 11.1MB - Virtual size: 11.1MB

.data
Size: 872KB - Virtual size: 1.3MB

.rsrc
Size: 128KB - Virtual size: 124KB