1b30bf6f8848e3232b70ac7a460a9c2e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b30bf6f8848e3232b70ac7a460a9c2e
Size

7KB
MD5

1b30bf6f8848e3232b70ac7a460a9c2e
SHA1

c8fa0f6aa78135d0e85b4c812053051b13a6498b
SHA256

d47b5ba0ec2d4265f0bd609b8308dca4bb706de3240aba46cf7fba04cb99066c
SHA512

364b41dd72560e0443eba42892831de23ddde94bce21a3e65b94d28d302b63331e6fabafb6c3a8b427169f3da3f0d6ef244921d14d5dffe2e45bed20b1c31409
SSDEEP

192:cCvpe+nmPToCJ9iNlA6xXLygUA54NrTcTy:cspe+niJmX354lT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1b30bf6f8848e3232b70ac7a460a9c2e
unpack001/out.upx

Files

1b30bf6f8848e3232b70ac7a460a9c2e
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.data
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE