fb379f653f8cb98dc86cfa0f908743a2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb379f653f8cb98dc86cfa0f908743a2
Size

8KB
MD5

fb379f653f8cb98dc86cfa0f908743a2
SHA1

a87f8da04c66815840470336701fc1ff7305aa1a
SHA256

73e5b1a8e0eea986e3feed4b72a5f9c190243e8d882d4c28fec5cd11b15de6e5
SHA512

18fd0d885445facb80a470c2a6284ce661bffda7e1d6bc5f82c7d8b92dc6f958efcbd5d07e4d7ecfbcda388085eb2d31af1973546c1fc142791e2e8c7b095af6
SSDEEP

96:9s8HqkSViOrjU7CyGR8A2OboFkEI1QGo6WjPPGvfYHW3hAlS:KHVJrjU2yG4xaE+QJXjVH+mS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
fb379f653f8cb98dc86cfa0f908743a2
unpack001/out.upx

Files

fb379f653f8cb98dc86cfa0f908743a2
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ