66fb43aa2d436e6cf3879583ffbe7a41 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

66fb43aa2d436e6cf3879583ffbe7a41
Size

793KB
MD5

66fb43aa2d436e6cf3879583ffbe7a41
SHA1

a0e6199d9d1d906f68641dd86341d78f9f36a661
SHA256

ec4cf8131946ae5dd5a97cb5947d7f0faf32dd6d2e11ffcbd119afa0958fac54
SHA512

dad5a00e148adc9bd1818a0fee12ad624e68052f44a95eb383e473df3a8af1bbfa61906fb7ff396e3d64a0ba1e5a3a0dd4de9c041acace0e0f1ff75b740ae42c
SSDEEP

24576:gs2c4Qnds+HzDf663XXubX8u+GQV5ly66sP2:J2c48s+T76QXebMuBuLvvP2

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
66fb43aa2d436e6cf3879583ffbe7a41
unpack001/out.upx

Files

66fb43aa2d436e6cf3879583ffbe7a41
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 757KB - Virtual size: 760KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ