cd46dcff3ac03fd8f55ec90fcfe35bb5[.]bin

General

Target
cd46dcff3ac03fd8f55ec90fcfe35bb5.bin
Size 105KB
Sample240509-dzah5aah47
SHA256 7ce6ef308d6c1d7f91590ef15d9ea18f800b21016d506c415c2c8eeff0c368c9
MD5 3c5d7ca120522caac889014f2445323c
SHA1 28d0331b95b46dbac51001a866e1ca69effd8e20
SHA512 0be66d2c59189e3679972608cae34ee38f77659a6cf89baf93aec610f34fb692ce6d5c442dbb49e0964bf9d03fc64fd00074fceb7296eab6174639d801227342
SSDEEP 3072:RWoOB3u3QiSU7c9xKLuNDHvqWqVg2QCAr60Q:gnBe3QiSU7cb9vJrq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3.exe
unpack002/out.upx

File Explorer

cd46dcff3ac03fd8f55ec90fcfe35bb5.bin

.zip 105KB
a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3.exe

.exe 109KB
out.upx

.exe 132KB

cd46dcff3ac03fd8f55ec90fcfe35bb5.bin

SHA256 7ce6ef308d6c1d7f91590ef15d9ea18f800b21016d506c415c2c8eeff0c368c9
MD5 3c5d7ca120522caac889014f2445323c
SHA1 28d0331b95b46dbac51001a866e1ca69effd8e20
SHA512 0be66d2c59189e3679972608cae34ee38f77659a6cf89baf93aec610f34fb692ce6d5c442dbb49e0964bf9d03fc64fd00074fceb7296eab6174639d801227342
SSDEEP 3072:RWoOB3u3QiSU7c9xKLuNDHvqWqVg2QCAr60Q:gnBe3QiSU7cb9vJrq
MD5 SHA1 SHA512 SSDEEP

Password

infected

a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3.exe

SHA256 a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3
MD5 cd46dcff3ac03fd8f55ec90fcfe35bb5
SHA1 0720befbacd39abc9e7258fc300c18756a22ddb0
SHA512 aeaa6710fd9505f4b88a50a1ae0caa05a6eb9e535a03caffd2feab3422d56d0a3b77bcb43687c9d458f9145e8c10b9aa8ab07da7a829ffeb5cacf51aa672115d
SSDEEP 3072:Uk4/L3EPTOdNHM9g54vnM8FD1Lsm1Mn75kT:OEPKdNsDvnDUmT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

142080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 44760d390675ffe7af63d89bdc73d15f15adc1580ace6b6f6dc4cd3f6df82943
MD5 a6d3af9f1467b01a213c0038adc04acd
SHA1 d9d190d5886a660dbf9a4701d2d48ef77e76289d
SHA512 851dbff8dedcc8f3e4b80f30bc54bb1d1630cdf92583a0b19c31f77b7b7ef76b5fdf0f5235ad46bfd4d91144fe65a6e77c55d36562d5deb5d08d79dd69382c04
SSDEEP 3072:j2TXlvnMpmnnnnYyRybSMh0zPTJnqtVCAV5cPcbnnnnnnnlBNnnnnnnz:j+iyRiScqrRgCsn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

cd46dcff3ac03fd8f55ec90fcfe35bb5.bin

a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

cd46dcff3ac03fd8f55ec90fcfe35bb5.bin

a1b12da4949b7d32a534d3277d55bb699ac5bcfb75e023af0b5d25b83a097ff3.exe

generic

out.upx

generic