8fb1de1c14403a90252aa7f5c63f4040N[.]exe

General

Target
8fb1de1c14403a90252aa7f5c63f4040N.exe
Size 83KB
Sample240901-xreyeszelg
SHA256 80f121cf8d38b3e3d32d869947892df002c7c7a92f32535f945a7a821ff3819d
MD5 8fb1de1c14403a90252aa7f5c63f4040
SHA1 db5626965dae3371eebfab95bc3ba97f38fab6a8
SHA512 1b4e002f04331c9778631f847e55149f3cd068c6f7e7456df8f38b38ef56ea322a7aeb543153c69480b86f55a5d79165d44e407bc706df8535bd31b5e805ba9d
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+CK:LJ0TAz6Mte4A+aaZx8EnCGVuC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
8fb1de1c14403a90252aa7f5c63f4040N.exe
unpack001/out.upx

File Explorer

8fb1de1c14403a90252aa7f5c63f4040N.exe

.exe 83KB
out.upx

.exe 135KB

8fb1de1c14403a90252aa7f5c63f4040N.exe

SHA256 80f121cf8d38b3e3d32d869947892df002c7c7a92f32535f945a7a821ff3819d
MD5 8fb1de1c14403a90252aa7f5c63f4040
SHA1 db5626965dae3371eebfab95bc3ba97f38fab6a8
SHA512 1b4e002f04331c9778631f847e55149f3cd068c6f7e7456df8f38b38ef56ea322a7aeb543153c69480b86f55a5d79165d44e407bc706df8535bd31b5e805ba9d
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+CK:LJ0TAz6Mte4A+aaZx8EnCGVuC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 47cb73357bb963ce346275c5c6ff3da77b2266e49ab6df654aa8df3a9651e014
MD5 73d4db1f8995dd575783259560c32ba3
SHA1 690a00897f197472083a4c1c8ecf4d82cbe590d4
SHA512 250d385ff56bd7054681ca192756461f9d86b0eea88d01d184988010c990af77117960c7473b8615f0d06c12f5b184c840dee9917dc60a5c8bbcb5c97317550f
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/j/Fnncr:XDeM7iNEkgiOb31k1ECTJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

8fb1de1c14403a90252aa7f5c63f4040N.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

8fb1de1c14403a90252aa7f5c63f4040N.exe

generic

out.upx

generic