75d09c9767b481ccbc9d49939e5a969f

General

Target
75d09c9767b481ccbc9d49939e5a969f
Size 54KB
Sample240125-3pw2taagdn
SHA256 50035669e0bab3a5b34c61c41672cf4c3674bd47bfa271c56ab593ee943eaac7
MD5 75d09c9767b481ccbc9d49939e5a969f
SHA1 8967e311dac5fc7b71dc368d8cc72ba0e27280d6
SHA512 a086471fe9872405f9cb481d668eb338b4e03e3e3c475d39611f1cffb2ce65501f60d5c84b408a77600c37dd2ebfd5858821b40e7d7fffb26d84d0b511c6029c
SSDEEP 1536:gRbIKgiTTnQFgTLjQsESQs28Wed0D42ia1C:gRd5TTQF6Qsxj28D0FFg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/out.upx	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
75d09c9767b481ccbc9d49939e5a969f
unpack001/out.upx

File Explorer

75d09c9767b481ccbc9d49939e5a969f

.exe 54KB
out.upx

.exe 64KB

75d09c9767b481ccbc9d49939e5a969f

SHA256 50035669e0bab3a5b34c61c41672cf4c3674bd47bfa271c56ab593ee943eaac7
MD5 75d09c9767b481ccbc9d49939e5a969f
SHA1 8967e311dac5fc7b71dc368d8cc72ba0e27280d6
SHA512 a086471fe9872405f9cb481d668eb338b4e03e3e3c475d39611f1cffb2ce65501f60d5c84b408a77600c37dd2ebfd5858821b40e7d7fffb26d84d0b511c6029c
SSDEEP 1536:gRbIKgiTTnQFgTLjQsESQs28Wed0D42ia1C:gRd5TTQF6Qsxj28D0FFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

120848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 09e96c75215746a597a5aa258248af4482cf98be15727440187433f930a6340e
MD5 26cd9a614cafd4e425069e2da4e5707d
SHA1 3b749646a1e91eecc522aa5f9c392cb7d99e1fb5
SHA512 07ac7bd9b8055ccb756b7704af566dc8845eb6ee139a721b838313dee9c8c29bc36d3fa34ab59c3d9c033fcc234917e47e98c692c007593f6e5bfde7f7761392
SSDEEP 1536:zBZMK/okgX0AfYeWHq8IgK/YSl+QtNDGCozvi:zBZMKAksBT0q8Ifx4Co
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

71675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

75d09c9767b481ccbc9d49939e5a969f

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

75d09c9767b481ccbc9d49939e5a969f

generic

out.upx

generic