d493e5d7ed02d0e65c4eede2a35846d1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d493e5d7ed02d0e65c4eede2a35846d1
Size

752KB
MD5

d493e5d7ed02d0e65c4eede2a35846d1
SHA1

2be78ce10eae429f8738e81d5e0ee91116012527
SHA256

9464a81e12b00e55636a9048d005ee847c0ac708e6c0a0fb5cf44df2ae9e39f2
SHA512

398d6bf9bddbe16392906872557ad5467c33641ea4cbf15afdd261ee79895128d2f1b9ba5278d79fc324fe67eec5494ec031a2d699e760e976c04a14884b4bda
SSDEEP

12288:rrziUZGk2E3R6AYRuQ8R2Rgh+lbvoikXmBZQONzTXsU/T7onEq/HTjpFY:HziUx2E3R6AYgRvwlbo0p1XontHpF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d493e5d7ed02d0e65c4eede2a35846d1
unpack001/out.upx

Files

d493e5d7ed02d0e65c4eede2a35846d1
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 840KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 751KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ