6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N

General

Target
6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N
Size 83KB
Sample241005-tzpaaa1gkf
SHA256 6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693
MD5 e2a4348b207eaa43fa97feed3c479930
SHA1 4934c66802287fbe5ef367e5c1ec5b05bf8fdc58
SHA512 6dd5653709a285f203f9d44da19ae559b9d3b7132603179f87eb5dc10f8c8232131b57d80819c7722debe3db452d517415dcd0ee3cfcde5fff4566ebc9e99a85
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+6K:LJ0TAz6Mte4A+aaZx8EnCGVu6
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N
unpack001/out.upx

File Explorer

6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N

.exe 83KB
out.upx

.exe 135KB

6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N

SHA256 6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693
MD5 e2a4348b207eaa43fa97feed3c479930
SHA1 4934c66802287fbe5ef367e5c1ec5b05bf8fdc58
SHA512 6dd5653709a285f203f9d44da19ae559b9d3b7132603179f87eb5dc10f8c8232131b57d80819c7722debe3db452d517415dcd0ee3cfcde5fff4566ebc9e99a85
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+6K:LJ0TAz6Mte4A+aaZx8EnCGVu6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 a6d7ae574cdb50e8e27f0bd77a1accdafc58c4e86750833de71066d820b5188e
MD5 85a3947f3a7c8317de3a57b90e6d0b2b
SHA1 1dbd53f195d30a9c23f6b92bd512bf6f3038fd69
SHA512 a5bd8a2113795713b61672a80a459677fe5bb13707fa4428d82c04d9b8a1eadc0a9e7dc79a79edb68ccc6a37c62e3b4517b0a9496afc6202022d10d579938b7f
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/f/Fnncr:XDeM7iNEkgiOb31k1ECPJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

6785cd39582dbaa8ed3edde1d4188c7629785d79765a2d723eb0b1610a7ff693N

generic

out.upx

generic