41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N

General

Target
41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N
Size 83KB
Sample241107-m5ceca1enj
SHA256 41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181
MD5 a31ab24650f1cb7302bc3085dd47d510
SHA1 cf4e3aa887f9c3cf1a6729eec043e8ec7243dd6f
SHA512 b263ced8a1cca2c7dceb7e2eee7a10b286c1dc914cb90060477912ed5a157fbb4447c1df7ad519e16a9122563314cd022721cfdf2aca3a7f742ff17b36078f35
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N
unpack001/out.upx

File Explorer

41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N

.exe 83KB
out.upx

.exe 135KB

41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N

SHA256 41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181
MD5 a31ab24650f1cb7302bc3085dd47d510
SHA1 cf4e3aa887f9c3cf1a6729eec043e8ec7243dd6f
SHA512 b263ced8a1cca2c7dceb7e2eee7a10b286c1dc914cb90060477912ed5a157fbb4447c1df7ad519e16a9122563314cd022721cfdf2aca3a7f742ff17b36078f35
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 ad4ee47ee5e5622f0912a820de21c8d69ac915819435e1f71c4ddcbceeedfa6b
MD5 5126beb7076eff4336ca2f00894c49ee
SHA1 0949596854690a7ce0eb79b3a46c751dfceb2be8
SHA512 f303908189d0e86d648890385b5f7946e01de546b3ff003f7f7cb8dc370c7be9b6b49c4a66981b8aa80a14c9d5ee8e0e291de0e63703399b8b7d4d5b11f974b1
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/A/Fnncr:XDeM7iNEkgiOb31k1ECOJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

41baa20e82d89b8c97fc534f0d017dd5813167b6316db2fe860413a75c6f4181N

generic

out.upx

generic