d3c43596fd6c91603b1d09d0f2c5d648 | Triage

Sharing

General

Target

d3c43596fd6c91603b1d09d0f2c5d648
Size

28KB
MD5

d3c43596fd6c91603b1d09d0f2c5d648
SHA1

06a82be80807355ce33add2106020cf6ef561136
SHA256

f7882faba3a2b66309454690d943a16f4b2f9c8ac9ffa8c946a8c6e3df7725ac
SHA512

d66c904d4c79d6884ead0d04d0e1f1cf773572b459da268bd798060564a2d8bd81ed9c4dfc55c441e910ff43319f4068f105b75e1dba1cda4e4bd67a968aa8f5
SSDEEP

96:/lxqs4vQiOXiJlwd9zx0ZLukSZTTwLaabmG8CL3uSTyaabmG8CL3uSTY1aabmG8G:/TqSXSY9Vk5T93jy93jo93jZMi

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d3c43596fd6c91603b1d09d0f2c5d648
unpack001/out.upx

Files

d3c43596fd6c91603b1d09d0f2c5d648
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ