de7957dc00a42eee7d3253a614fa1353 | Triage

Sharing

General

Target

de7957dc00a42eee7d3253a614fa1353
Size

31KB
MD5

de7957dc00a42eee7d3253a614fa1353
SHA1

dfaa6c7c458f33c0fb5b5820486dac6077f48c2d
SHA256

b82b5a1622098e3a7210810c4f0d09ef63a8e05e60e04f8269d0ac5da148fadb
SHA512

dae23f681dbd84d4ae22382a821c13398dfa3abd9008ad0c0b9aaebd2c1f5a3897fe7c9f77d0c551d0e7bbfda83a07ea5ed7811bef9f1291f85fc3b02b0fec35
SSDEEP

768:wVMy1GnHoVw8OXIOeyiUoqW9ndAJXWxvVmeBHuOvuqTs68D9Gg30KD/:wKy1GH6VwZtJXWxvVTcOP98ZGg3jD/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
de7957dc00a42eee7d3253a614fa1353
unpack001/out.upx

Files

de7957dc00a42eee7d3253a614fa1353
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 639B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ