kitty[.]exe | Triage

General

Target

kitty.exe
Size

766KB
MD5

8ba2320f4fb1fed276df1e68067d2cd0
SHA1

13d108412ffe583f16fe45459c19df64d44bcf17
SHA256

b3a0a5812ccc7f7a9962c0519d464bd8d45f4042b4838583b3686500db614f53
SHA512

fb9cfd0f1e35800fbda65c0d5538a04852a43e8b5a81172e038e7c94166236bb4dbecc78dabf45536e0e85e6aff4bd595bbc73249d26c73fc8c2d3c31f49a1e0
SSDEEP

12288:SFjPQHY2vn21AuMXbOCB+BLIKzv5rJchwXaBKe9lojnESsj4vBot5UW7qaVcA:BRvq3OS22cK75rWwXaBr9GXvM5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
kitty.exe
unpack001/out.upx

Files

kitty.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 700KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 281KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.5MB

UPX1 Size: 700KB - Virtual size: 700KB

.rsrc Size: 66KB - Virtual size: 68KB

Headers

File Characteristics

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 15KB - Virtual size: 14KB

.rdata Size: 281KB - Virtual size: 281KB

.eh_fram Size: 197KB - Virtual size: 197KB

.bss Size: - Virtual size: 83KB

.idata Size: 14KB - Virtual size: 14KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 294KB - Virtual size: 293KB

UPX0
Size: - Virtual size: 1.5MB

UPX1
Size: 700KB - Virtual size: 700KB

.rsrc
Size: 66KB - Virtual size: 68KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 15KB - Virtual size: 14KB

.rdata
Size: 281KB - Virtual size: 281KB

.eh_fram
Size: 197KB - Virtual size: 197KB

.bss
Size: - Virtual size: 83KB

.idata
Size: 14KB - Virtual size: 14KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 294KB - Virtual size: 293KB