a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N

General

Target
a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N
Size 83KB
Sample241107-mt58aaznht
SHA256 a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6
MD5 bd2a9819eeb9c0fb7ea875b99cc2ef20
SHA1 32b86b68673dfc5cde96428587939c215418476c
SHA512 b312967aa881d55bc3fb1a993ebabdf81187048d914a29cfbb04cc9c3c2f1a6f7638c7dfeaf54d590d7088c6517742cd4c5eeba22842ab1c54db8964af12a589
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:LJ0TAz6Mte4A+aaZx8EnCGVuR
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N
unpack001/out.upx

File Explorer

a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N

.exe 83KB
out.upx

.exe 135KB

a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N

SHA256 a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6
MD5 bd2a9819eeb9c0fb7ea875b99cc2ef20
SHA1 32b86b68673dfc5cde96428587939c215418476c
SHA512 b312967aa881d55bc3fb1a993ebabdf81187048d914a29cfbb04cc9c3c2f1a6f7638c7dfeaf54d590d7088c6517742cd4c5eeba22842ab1c54db8964af12a589
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:LJ0TAz6Mte4A+aaZx8EnCGVuR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 dc7647015301519dc1e100cd1139605a9e2d5731e8da5d131d3597807c348752
MD5 e95bda6048192e7559d2ea075295dcfb
SHA1 ed386ff3255587e8410abbe56d2df031cb24fffc
SHA512 dba1c5ff7d4bd5742e39a96e5c4a4063eae5679c1e500095496b601b309098986efba52a71e4ddc4b436865f88f0786c88c78afe47822dccc89809756c7f0dbf
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/0/Fnncr:XDeM7iNEkgiOb31k1ECyJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

a56af58f8328693c308e0c7e7316ab5923bf389d0e5d81fe8c34089be3e1a8f6N

generic

out.upx

generic