fa5bafa88fd2412457261aba0db39e4a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa5bafa88fd2412457261aba0db39e4a
Size

12KB
MD5

fa5bafa88fd2412457261aba0db39e4a
SHA1

f4b8b917e2f7100a754c4932c3c329662fab3533
SHA256

1e97794f7267b5c5f48cf8fe60539ec4596d1b7eafe5bec0eff445b9bfe145c1
SHA512

18fe09eaab5771e9846eeed0dca270b4978be186b8d2aba67d6c1c33a4bfec2d26efee7979857a3cb5e4bdffbf1ac99491488d56d5b1398726bcc35047c173df
SSDEEP

384:ZiMCrc1CUQ5aF15o4ZZVPnNmSBSkmGETHWjk:aryCT5aFlZZjmSUHJT/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/10c63ca494a187f64eeac3e2e5f7ffab.EXE	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/10c63ca494a187f64eeac3e2e5f7ffab.EXE
unpack002/out.upx

Files

fa5bafa88fd2412457261aba0db39e4a
.rar
10c63ca494a187f64eeac3e2e5f7ffab.EXE
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE