f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN

General

Target
f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN
Size 83KB
Sample241012-xtt55a1bpj
SHA256 f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539c
MD5 b317793b39e11a49e3e83ba5c830de40
SHA1 b628fdc599600b8888777e731e24452ccf89c80b
SHA512 daf2e03e8d92fd856b191af12df6231425626dfe2217d0d58d0fa26483389599f0dfe2f46db3f01166daa342fdfa1821cc80459e2d0f628855dc176b0c58143e
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN
unpack001/out.upx

File Explorer

f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN

.exe 83KB
out.upx

.exe 135KB

f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN

SHA256 f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539c
MD5 b317793b39e11a49e3e83ba5c830de40
SHA1 b628fdc599600b8888777e731e24452ccf89c80b
SHA512 daf2e03e8d92fd856b191af12df6231425626dfe2217d0d58d0fa26483389599f0dfe2f46db3f01166daa342fdfa1821cc80459e2d0f628855dc176b0c58143e
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 578e1d4f189b498e92e9796529afa51ec5ac3ba92cb0fafd95145ab786e88eef
MD5 bccabca82b4bb1b5d04b13bf21cf30e8
SHA1 d83e5afb750828456833d8bd59da8c65cdd9b7f6
SHA512 fd912274d1aab73775e66dc750a725581407838fddea2adf0d54e6589c021ecfa2370ca9a87e7a042b8f7f949015e8e30839848cf3c5a776f3da3aae01688d54
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/Fnncr:XDeM7iNEkgiOb31k1ECiJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

f973df446cdbacd1ea4c11ac35aac032fb9238933e9d2f83f3e1451fbd9f539cN

generic

out.upx

generic