501b1ec3241e8ddda996abf768459ee9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

501b1ec3241e8ddda996abf768459ee9
Size

104KB
MD5

501b1ec3241e8ddda996abf768459ee9
SHA1

7620bc274e695bf1f86e552f40100e4e70d875a1
SHA256

4669ae584617b412de6c14ea57373a3ec6d19c0a085ca9cc3975fc8b67eca912
SHA512

f1e648e76deffd2cf565e51d0f8809e6fcfcfb4f456402142e925fce2afd945ab74108fc6b027cddc114d73a28fc05f361f292a2c16df10009e42ecaf4f020bf
SSDEEP

1536:9kb3S2eoonVKofU0FEG4N+S1pud/WJpLA5zBfXNu47IYN8YKEsi5K2tsj/kR2J:9ku2eLRFAkdRr8hEJ0g/0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
501b1ec3241e8ddda996abf768459ee9
unpack001/out.upx

Files

501b1ec3241e8ddda996abf768459ee9
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 102KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE