ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N

General

Target
ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N
Size 83KB
Sample241014-ec5lesscrr
SHA256 ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6
MD5 d0d7ba38ca353df84e9135de4051b940
SHA1 e82aa7dd25a01e7d38015d8e817fdc3113e223f2
SHA512 df631caa44d637ae79ddd42425721c120e6c00d747f4a5f7df39f559870f7b498af15995f5106d96c0b2350761bdd84111ebf6b2f19e78233e6dea121e1ef04e
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N
unpack001/out.upx

File Explorer

ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N

.exe 83KB
out.upx

.exe 135KB

ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N

SHA256 ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6
MD5 d0d7ba38ca353df84e9135de4051b940
SHA1 e82aa7dd25a01e7d38015d8e817fdc3113e223f2
SHA512 df631caa44d637ae79ddd42425721c120e6c00d747f4a5f7df39f559870f7b498af15995f5106d96c0b2350761bdd84111ebf6b2f19e78233e6dea121e1ef04e
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 04484af730507be6664995b7523d2e7aa0c3acacafed768f0d90bf51e0c1481c
MD5 09e8f28ef522cb4e6624e527fa3674ba
SHA1 c47dc5268d13dde2d1239cba45758e5936b9955c
SHA512 12cc1f3ad78de07233caad2680098225f7acdc7f5022724880d9dabdcb3d6ec31e0bb0445b3455503bdf147a4e4be3b1e7ef4d59068a5ba03cbe3d09592e11e1
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/c/Fnncr:XDeM7iNEkgiOb31k1ECaJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

ce01e80e405e68524c131344ad51a50a6b33b35cc7edb7edcdb9ba63729149c6N

generic

out.upx

generic