9240392fa2b711bbbc4b0d5a7fc7e414

General

Target
9240392fa2b711bbbc4b0d5a7fc7e414
Size 24KB
Sample240205-r1vgksabe2
SHA256 c1814ae96627b231ecf1672771a1b8cbb614e1de590e4e5d6dc8e4b84995e7cb
MD5 9240392fa2b711bbbc4b0d5a7fc7e414
SHA1 455af547231f861fa7629b529187a43a174573a7
SHA512 a7a8e94e594a0a9e4d54763996ba8f30f694d70099f25bb23f8893e94e635d3e013ec85268ce7c052162b7fec161fe80113effd82cacd185003ef7d70b68beb3
SSDEEP 384:VJl4a2PITj5c1f39hyw8NTvvPpTGNJEh7UV0HYGYYaQqB4Wl4p2:B4a2ioNhywwRaNJEhwV+YD6bWaU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/out.upx	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
9240392fa2b711bbbc4b0d5a7fc7e414
unpack001/out.upx

File Explorer

9240392fa2b711bbbc4b0d5a7fc7e414

.dll 24KB
out.upx

.dll 60KB

9240392fa2b711bbbc4b0d5a7fc7e414

SHA256 c1814ae96627b231ecf1672771a1b8cbb614e1de590e4e5d6dc8e4b84995e7cb
MD5 9240392fa2b711bbbc4b0d5a7fc7e414
SHA1 455af547231f861fa7629b529187a43a174573a7
SHA512 a7a8e94e594a0a9e4d54763996ba8f30f694d70099f25bb23f8893e94e635d3e013ec85268ce7c052162b7fec161fe80113effd82cacd185003ef7d70b68beb3
SSDEEP 384:VJl4a2PITj5c1f39hyw8NTvvPpTGNJEh7UV0HYGYYaQqB4Wl4p2:B4a2ioNhywwRaNJEhwV+YD6bWaU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

74852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 59ddae8c8b5794a4a776c071b1503611d8188668ece2d641350adec684567517
MD5 7d93ba8d4f89c8646954facedf7eb181
SHA1 69e28587a66dc00638f4a386659e9cabc9f0bf0c
SHA512 e9414fc3270b44ec11ceb5ec2a09202083840f8ceb852016fdbe8d388e7527ed1dae3b53de3a89bfd6869321413837531ee805db7c5a1f5c9fc5bbdd8ad99507
SSDEEP 768:MmmzBiTFrujAWbewvPHOJByeIp21ypDaRjFPNC2p2ViwWmDvpVT7H:zIAB4cnFPc2cAwjpVT7H
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vmp0

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

9240392fa2b711bbbc4b0d5a7fc7e414

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

9240392fa2b711bbbc4b0d5a7fc7e414

generic

out.upx

generic