21c4ff24de444c7d6af1e9860363d84b | Triage

Sharing

General

Target

21c4ff24de444c7d6af1e9860363d84b
Size

218KB
MD5

21c4ff24de444c7d6af1e9860363d84b
SHA1

af84f506bc9f930feef53432a7f550ede15390ea
SHA256

a7b6409ecd38c3d6a6a297c3ab01bd8c43d305c07ea16f9c3173eefdc2d89c7a
SHA512

401b5c082da7b99c117fbd20dc3040ea58a180d565528e065e62b99fd1a093a7bae01c0e35d1a494fa8916ea751370b918e4ba4b6b2595276ea6f59d9233715c
SSDEEP

3072:8uaIsnCeptgrtyD9wlOIzbS42QTcvgSoGCGkfQqLEZ78JVkM0GKRicWDntHqKkJ:l7troD9wpzbX2+uH/uJVp0GGI5s

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
21c4ff24de444c7d6af1e9860363d84b
unpack001/out.upx

Files

21c4ff24de444c7d6af1e9860363d84b
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 200KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ