421fe0b49dc08b9d1004bdf7f596e6f9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

421fe0b49dc08b9d1004bdf7f596e6f9
Size

243KB
MD5

421fe0b49dc08b9d1004bdf7f596e6f9
SHA1

949bda7b054efe28790cdb3c043163e3cfa66487
SHA256

a2687353469839a962ceb9a30f7d1a61ca56ba28a87f0299f17daf73b0331ea8
SHA512

8110d684e285acd306c81e1de2e2f73df0a48b18a027e9c861c25678639f9af39c91d9d0246dbfc49c6caff01fbfb0e38aa42399a395141be3e296fdf419763a
SSDEEP

6144:7wpY4K5KZ6U4Sf0X7nyIaDrapWf2rCbsaxPTGd07F:kSh5KZB4Sf0XWLqpWf2mbscPTxh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
421fe0b49dc08b9d1004bdf7f596e6f9
unpack001/out.upx

Files

421fe0b49dc08b9d1004bdf7f596e6f9
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 241KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 404KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE