bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N

General

Target
bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N
Size 83KB
Sample241107-q5asastclf
SHA256 bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596
MD5 5e1163e898a04ca9086a9e16daff4de0
SHA1 9a9ee77f33d184fa202128c77f693a6e9c09b04c
SHA512 7754e35892f50d58c6efbd8514188f233bc9931fe87aee3b592e53ceea148c1e4a9d6992217c113c395d12f3d57eac3a5b2dd5fcc47f3051801fa6ee68d63808
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N
unpack001/out.upx

File Explorer

bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N

.exe 83KB
out.upx

.exe 135KB

bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N

SHA256 bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596
MD5 5e1163e898a04ca9086a9e16daff4de0
SHA1 9a9ee77f33d184fa202128c77f693a6e9c09b04c
SHA512 7754e35892f50d58c6efbd8514188f233bc9931fe87aee3b592e53ceea148c1e4a9d6992217c113c395d12f3d57eac3a5b2dd5fcc47f3051801fa6ee68d63808
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+YK:LJ0TAz6Mte4A+aaZx8EnCGVuY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 ab2cd961c45a03558f4db4dd425c3473cfa5185f34329e05db6b94c5cb9b8df8
MD5 c6118260ad0eb364602c4c38046decde
SHA1 3aa7dd4f85edabac892f849dcd300aeab3757c73
SHA512 7050932a54fafb5812bb03e3d7953fe015e2b23ca6781405efe4f8228c946473a6be51f6c26b8ce8d3cf7a5f3d842b9546b4dec36d4a03f64fe419de945dbb04
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/Fnncr:XDeM7iNEkgiOb31k1EC5J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

bf94ac83c0327ff51bf4507e3a0eeaec47710c54ff74613c45fe022d82b28596N

generic

out.upx

generic