edbfdd04d154060b82f386191ba772e0b9122e2f82a4e3c0e3ddf65fc7a8b55a[.]exe

resource	yara_rule
sample	UPX

resource	yara_rule
sample	upx

resource
edbfdd04d154060b82f386191ba772e0b9122e2f82a4e3c0e3ddf65fc7a8b55a.exe
unpack001/out.upx

edbfdd04d154060b82f386191ba772e0b9122e2f82a4e3c0e3ddf65fc7a8b55a.exe

SHA256 edbfdd04d154060b82f386191ba772e0b9122e2f82a4e3c0e3ddf65fc7a8b55a
MD5 16b332205d167a6a6f76c5293aa8f201
SHA1 40c0fba9107d270cf006f58f4fecc9742f806a2b
SHA512 ff18c351f1f86134f79a535eb5f6045c5dfdf3ab9e632d15a5266c86e25c0cd675a88f457a99f3ae6a92d0929d35f703a366b0d11fac1ffaa09e6f44f39e11f5
SSDEEP 393216:Z8V2nhTIrvYzEWmn+FBhwFDbllTqkl6eFh3zZNgni9HkHxHLCA9arP1A0+3ERPWy:OV2h2QzE0FTIpt6eFl1NykmxeS3u
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

67760432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

.rsrc/0/GROUP_ICON/1

SHA256 cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba
MD5 38388dda6548693f4d42f2241a4218d7
SHA1 78bedd12a20f97e31e58742381f3d0ca1edb4715
SHA512 ae55ba7b525776fca49f0490d7271973e55fbf12ada9e27da133b51a2e51d9de5a2b083ffa4b0545f2bc89cabcef7f91fae55cf8fd39e282ca45859335d93119
MD5 SHA1 SHA512

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/0/ICON/1.ico

SHA256 798188940b6d4631252ba7d3afe776286a6730115425060bb297324f0fbc05a3
MD5 4066603d20301525d21b4e72c4be27e7
SHA1 3fa7906056b56bb862e43cef47c835c5a5dd5c12
SHA512 2c820a4f6ac5193ce2a3e90b252c9a7256865df5041cdb4131d0c3509d81816fa4c67434697a16702ecb68337e7eb4f89b1043dbb3ebf3db3e6887a7dbbb3aa0
SSDEEP 384:5x1DHCrBmwAwDo4JBzHALXBr1N1MEqd5b/UrvYGXq/UwpsIKOayLDpsO+UfE3F+N:T1ovo3cEMoM
MD5 SHA1 SHA512 SSDEEP

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/MANIFEST/1

SHA256 4293ac2cf64e9282bdbf6fdaec564ea02b3800888fac4b6b9770c1121195f67b
MD5 72dfd96a765607076c7da4eb4a2341f5
SHA1 69c52125e78bda7e5485ddbb5a1cca572896590d
SHA512 5d3490d71a11e54ab18d85bfe4ef85a8ac72532f977599958cf1e4178dce1eadff256c2854a543a81f306c20b28fffaf00cfb560bdc22e7f2ae870f94be94549
MD5 SHA1 SHA512

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1062/version.txt

SHA256 084ae8d090b7be01ecea020ede1336dcd8b49cc86ce3d177f8987ad32d6579fc
MD5 1193c638a85f55ff9d812110ec3047dd
SHA1 e2d0b11617851d3c86f6dc8e4ad25fe6b5446e88
SHA512 91e7c44bd814baf52a481b8a854dd2e82bb2168d52a769ff2bec978f70aa394b376e75324b3068a779e21b0445f6eae6f2399da107188ba0c1a7064374da42f2
MD5 SHA1 SHA512

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc_1

SHA256 0516578a235ec3557c8c1a912b7c5be18eb03a257380452702016ac7c801f7dd
MD5 a097e484bddb883c23e470df4f631531
SHA1 8ccf34e3d04789ed3b264b02d939029b764c51c6
SHA512 204553186d1966687b65d3d83d45a31bfb87385daffb77868a2dbb16d19ec59a7eba98386e40e75228ae77485058df5fd33c41095a740c47ab0dfea8e14b2312
MD5 SHA1 SHA512

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 d35623d64b3d6ddff44543a8cf13e33bc0f1f5ab6ebd83ee43545a8bf69dc90e
MD5 db29aaa12b503bd91631ac2cc8ee8f11
SHA1 4468cc20d5b6503bb86276501f54dfa548d6f7a1
SHA512 46beae20a1b3d205d8deb176ba730f20d4d928b141daaca2de0133bf941f5f08443ce00ab7e651b00b4ee36d94dcdc401cbf43d40364dc5b375147d0408a2fc7
SSDEEP 393216:n8V2nhTIrvYzEWmn+FBhwFDbllTqkl6eFh3zZNgni9HkHxHLCA9arP1A0+3ERPWy:8V2h2QzE0FTIpt6eFl1NykmxeS3u
MD5 SHA1 SHA512 SSDEEP

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 a22f34d34c1b2f3ececedb23f589acd8056d760c214c18f5d6d934237095ee43
MD5 f93d29135c0da92a6053ea3da1bf1ccc
SHA1 8de3598d7a803b28efc7dc9eeddef571cc649466
SHA512 b81eb788ef855e729ead691b892bf444c44dd4979bdb3cb68a17133ea2c4b6ea05c4f1bce4390e7051f54337a13840760a4ead6d71caf4352454b759b666eadd
SSDEEP 393216:11jNa16A0ggeFDLfS1JnB3Zdp1uPGiSPWw1J29A4HGzomSHGUBOO5X4xG5h13TQI:TJa163TedfUVfp1uVS+w1x4mQ94sv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

19.6MB

Virtual Size

19.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12.6MB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

30.1MB

Virtual Size

30.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

568KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1023KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

605B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

399KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

edbfdd04d154060b82f386191ba772e0b9122e2f82a4e3c0e3ddf65fc7a8b55a.exe

generic

.rsrc/0/GROUP_ICON/1

.rsrc/0/ICON/1.ico

.rsrc/1033/MANIFEST/1

.rsrc/1062/version.txt

.rsrc_1

UPX1

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

edbfdd04d154060b82f386191ba772e0b9122e2f82a4e3c0e3ddf65fc7a8b55a.exe

generic

.rsrc/0/GROUP_ICON/1

.rsrc/0/ICON/1.ico

.rsrc/1033/MANIFEST/1

.rsrc/1062/version.txt

.rsrc_1

UPX1

out.upx

generic