4a5a39ba1066131da24549e6339f758c

General

Target
4a5a39ba1066131da24549e6339f758c
Size 12KB
Sample240108-ea4lcabeg5
SHA256 3fa0b0d0b6b2818b3812740a4fcc37a12a7eb999e8b6773659dce0f2d19f7a81
MD5 4a5a39ba1066131da24549e6339f758c
SHA1 49ceec283aecd71df3c248760290bc6b87dd1a8c
SHA512 2cc460a4709ee0c127a6f871b5d71a186315db0ec0fdc807ae961eb232cd9bdb7216dfcc4168ebb43b34c80dc5aea58113a365e168316c651d9a6f257a1e8f16
SSDEEP 384:VapMlKzzzqoU/xHgao3uZlXxZ3xGtVEe:wMlKPzmFogZhGtVE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
4a5a39ba1066131da24549e6339f758c
unpack001/out.upx

File Explorer

4a5a39ba1066131da24549e6339f758c

.exe 12KB
out.upx

.exe 16KB

4a5a39ba1066131da24549e6339f758c

SHA256 3fa0b0d0b6b2818b3812740a4fcc37a12a7eb999e8b6773659dce0f2d19f7a81
MD5 4a5a39ba1066131da24549e6339f758c
SHA1 49ceec283aecd71df3c248760290bc6b87dd1a8c
SHA512 2cc460a4709ee0c127a6f871b5d71a186315db0ec0fdc807ae961eb232cd9bdb7216dfcc4168ebb43b34c80dc5aea58113a365e168316c651d9a6f257a1e8f16
SSDEEP 384:VapMlKzzzqoU/xHgao3uZlXxZ3xGtVEe:wMlKPzmFogZhGtVE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

59520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 6d490f218d313878270039a57e413096d2dc775cf9bb9c271e2bbbfac5bd44bd
MD5 b906673896fe770b240f4b698a258ee7
SHA1 62f762776d0d825af6acccc4ff4a7305a25527ef
SHA512 8ce27568abe9af5af297c9146a9c5caa8747e27e89aa0f5ab17a9af8d693e9825a069dad187ea2f31b21d0df05d5bbbec2f6239baaee62af4269d36a3d19060f
SSDEEP 192:nmy1nDVEV0dwjP3xBCNi/0RH8hIjPcgnWpKlNDjDicXptjD/6er2LmFB:54P3/9/OcInWgLD/i6fJrq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

4a5a39ba1066131da24549e6339f758c

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

4a5a39ba1066131da24549e6339f758c

generic

out.upx

generic