ba76d8ddb5c8d25b6904c5e4ece76d12 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ba76d8ddb5c8d25b6904c5e4ece76d12
Size

55KB
MD5

ba76d8ddb5c8d25b6904c5e4ece76d12
SHA1

65604c434c2409747718136de42ee0d27c04e0c9
SHA256

d00493fe6c35d11ea452eee14d0c9ca0fa5f0e5cdc43b2ef198b210e6e2d0c10
SHA512

cdef67bba84b30a72998f28f6ffdf08b52396d745436641ea75456581a7137e2071ba189a6ea37a4aac4cc26bbafc8471404aaa68b5f3a1e7c513cbe9cdb761a
SSDEEP

1536:d8f1BIQndGQXkPI9Q1be37SE8P911obYpbbHMAH:e3IQ0aCxe37YWYFs

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
ba76d8ddb5c8d25b6904c5e4ece76d12
unpack001/out.upx

Files

ba76d8ddb5c8d25b6904c5e4ece76d12
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 639B - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE