599340df971b6a1c12e1a3a1c3abdc17

Sharing

Copy URL Twitter E-mail

General

Target
599340df971b6a1c12e1a3a1c3abdc17
Size 355KB
Sample240113-2eppbafbdm
SHA256 6ea381565165a68bd3558b2458a673023e2e1bd46dda3f18d2baad0ca9bb2a8d
MD5 599340df971b6a1c12e1a3a1c3abdc17
SHA1 75dfcdebc0b295377c799dd4c3e298c29ba3f4ef
SHA512 c5e47fca97ea329fbd2a2aa6d034fa23fb356b7663a021f1fd1acac14c35eba57d8032304027e50825bbb91fe9ca4b0571ed48c022e29bdc8c281cbe14de21b6
SSDEEP 6144:7Qw0WAtKvhICR0U6C6XxfmVD4VQy2/qBDZ3+C/CjqMrsG8C1Ncys5:0w0WAtKZPeRONp2Z3+ejCMZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
599340df971b6a1c12e1a3a1c3abdc17
unpack001/out.upx

File Explorer

599340df971b6a1c12e1a3a1c3abdc17

.exe 355KB
out.upx

.exe 682KB

599340df971b6a1c12e1a3a1c3abdc17

SHA256 6ea381565165a68bd3558b2458a673023e2e1bd46dda3f18d2baad0ca9bb2a8d
MD5 599340df971b6a1c12e1a3a1c3abdc17
SHA1 75dfcdebc0b295377c799dd4c3e298c29ba3f4ef
SHA512 c5e47fca97ea329fbd2a2aa6d034fa23fb356b7663a021f1fd1acac14c35eba57d8032304027e50825bbb91fe9ca4b0571ed48c022e29bdc8c281cbe14de21b6
SSDEEP 6144:7Qw0WAtKvhICR0U6C6XxfmVD4VQy2/qBDZ3+C/CjqMrsG8C1Ncys5:0w0WAtKZPeRONp2Z3+ejCMZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

739008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 0fd3568f2d6854a05e4fef09e580d49e600135fa92c72431de4af374046634e8
MD5 25904af50ce78798fcd8bd9a5ebb41f8
SHA1 959e3bd6ab05d52486d50a7637cce970ef8debb7
SHA512 7087597a59a915ede1fdf7ba28e5aa1587bbd215b744d372f42f902ddfc459ca9393f690d3dd93773a49beaa4b51b54910a7d3739d9606804d9686ea68962a23
SSDEEP 12288:S6ignMI+nuyUoNZ1F6W4hTmMeyAs/vm1E25w6x2Z3+ejCMZz:S6ZGOoNjFehTP9AfEGHoseR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

487888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

473KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

599340df971b6a1c12e1a3a1c3abdc17

generic

out.upx

generic