tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

4.2MB
MD5

b868f691271c55662fddf5d732bd07e5
SHA1

b10e9c0135144a0c99122631c6422a2cdf39c8d4
SHA256

4ebb2bd75c78469bc1a92b5fe5086efd4712d0d28c50011d3df0631c518a44c1
SHA512

4eff9d4537e92b85e129c018635ae469abe1acd562ab7a081c14192fb768e7fd2402bc8db338eeb753b1c9dbc5decb3e19685e69c2a0cd2d696aa3d2c5e2bfac
SSDEEP

98304:uALdWXkBrMF1ET1JxfxDNcrGW6kyHaRe90A/uZunJuu9MB7wDnpFVw5Y7bR:uSTtZJT6rGWryH/90AmZnul1wsR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

tmp
.exe windows:6 windows x64 arch:x64

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:32

Not After

01-09-2022 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:a3:23:bc:c0:96:a6:d2:36:eb:ad:23:e6:57:48:ec:42:db:91:6e:e0:e0:7a:6f:8a:1c:b1:7e:92:6c:b3:cf
Signer

Actual PE Digest

7b:a3:23:bc:c0:96:a6:d2:36:eb:ad:23:e6:57:48:ec:42:db:91:6e:e0:e0:7a:6f:8a:1c:b1:7e:92:6c:b3:cf

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 619KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 295B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 422KB - Virtual size: 421KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 862KB - Virtual size: 861KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

7b:a3:23:bc:c0:96:a6:d2:36:eb:ad:23:e6:57:48:ec:42:db:91:6e:e0:e0:7a:6f:8a:1c:b1:7e:92:6c:b3:cfSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.7MB

UPX1 Size: 4.2MB - Virtual size: 4.2MB

UPX2 Size: 512B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 240KB - Virtual size: 619KB

/4 Size: 512B - Virtual size: 295B

/19 Size: 422KB - Virtual size: 421KB

/32 Size: 82KB - Virtual size: 82KB

/46 Size: 512B - Virtual size: 48B

/65 Size: 862KB - Virtual size: 861KB

/78 Size: 557KB - Virtual size: 557KB

/90 Size: 139KB - Virtual size: 139KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 42KB - Virtual size: 41KB

.symtab Size: 378KB - Virtual size: 377KB

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

7b:a3:23:bc:c0:96:a6:d2:36:eb:ad:23:e6:57:48:ec:42:db:91:6e:e0:e0:7a:6f:8a:1c:b1:7e:92:6c:b3:cf
Signer

UPX0
Size: - Virtual size: 3.7MB

UPX1
Size: 4.2MB - Virtual size: 4.2MB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 240KB - Virtual size: 619KB

/4
Size: 512B - Virtual size: 295B

/19
Size: 422KB - Virtual size: 421KB

/32
Size: 82KB - Virtual size: 82KB

/46
Size: 512B - Virtual size: 48B

/65
Size: 862KB - Virtual size: 861KB

/78
Size: 557KB - Virtual size: 557KB

/90
Size: 139KB - Virtual size: 139KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 42KB - Virtual size: 41KB

.symtab
Size: 378KB - Virtual size: 377KB