bf5149ca5a249825696d8064af3511b3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf5149ca5a249825696d8064af3511b3
Size

8.9MB
MD5

bf5149ca5a249825696d8064af3511b3
SHA1

18a4b932bf04c91ad36dd9a0dd0d42715e554fca
SHA256

76da06df4c76753140915f36e67702c99acd7f52e913fb6bbef5b3cd7d6926d9
SHA512

d36155b721364389594991d304ebecc84b39a4d48eae86ff34e7c42274425752545d2f2c2e02fab5ce7fe6bea5af30db991cfa3a2089aecb6fceb0948e388e6e
SSDEEP

98304:dE35E38E35E3oE35E3GE35E3IE35E3FE35E35E35E36E35E3JE35E3mE35E3iE31:F

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf5149ca5a249825696d8064af3511b3

Files

bf5149ca5a249825696d8064af3511b3
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 472KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 264KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 38KB - Virtual size: 196KB

BSS
Size: 12KB - Virtual size: 192KB