fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN

General

Target
fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN
Size 83KB
Sample241107-mzsjdatldk
SHA256 fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635c
MD5 01d13b2e9f030164d8614a94054c5b00
SHA1 d36aac929e5a0b55808d89a3f7f3107049588cd4
SHA512 e12df39581badcfd66fa7de921961a6a164fd63580a6ae1081be2f3b01315b618910dcaa7307e2cac390860ea6b00895118a2965e7d1bad35dec689193ac2e66
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN
unpack001/out.upx

File Explorer

fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN

.exe 83KB
out.upx

.exe 135KB

fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN

SHA256 fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635c
MD5 01d13b2e9f030164d8614a94054c5b00
SHA1 d36aac929e5a0b55808d89a3f7f3107049588cd4
SHA512 e12df39581badcfd66fa7de921961a6a164fd63580a6ae1081be2f3b01315b618910dcaa7307e2cac390860ea6b00895118a2965e7d1bad35dec689193ac2e66
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:LJ0TAz6Mte4A+aaZx8EnCGVup
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 14c197ec007ddff6244d27ea35d90abc4304779856be5f2abcf533a3ac0f0aa1
MD5 d813ee8de7999328ca0152a7340bbabc
SHA1 1d37545b6870411728517c388cd371f69b63ad1b
SHA512 a5873a9577a134a20a4a85582bfc9bd6712a9e532547b1afa64b0541f93795f18c6cb6499cb2e7beb6212f3110cf87f69cba876015670e41244249ca0da1921b
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/0/Fnncr:XDeM7iNEkgiOb31k1ECiJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

fbd1ca2f930d24d3fb83afc1b98d4ab1d7db3d9f6617dac99e70e087fd3a635cN

generic

out.upx

generic