e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N

General

Target
e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N
Size 83KB
Sample241107-q7129sspat
SHA256 e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789
MD5 cdcaf86795c9f592dcb111fab7061540
SHA1 1794d748f784b0773fd25b714ff06ec554ba638b
SHA512 e2ca73483d87f7423832a39629ab4ea592238c18ea24ba3fdd03c9ff65197067b220cd98c2b994491c4cc8147babb45ff8fe1c0b3555ce73b06d311597cb7a62
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N
unpack001/out.upx

File Explorer

e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N

.exe 83KB
out.upx

.exe 135KB

e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N

SHA256 e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789
MD5 cdcaf86795c9f592dcb111fab7061540
SHA1 1794d748f784b0773fd25b714ff06ec554ba638b
SHA512 e2ca73483d87f7423832a39629ab4ea592238c18ea24ba3fdd03c9ff65197067b220cd98c2b994491c4cc8147babb45ff8fe1c0b3555ce73b06d311597cb7a62
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 3173b61e2f1ecc0e0851c788d07d3a5836d36f496b5cf97726e5ca01d56244e7
MD5 83d3a740b1bb5a710e1337d988f1a4a0
SHA1 aaaa07cbeaee79dfc5efb5d97feddf0f9467448b
SHA512 ec5ee957dc12e67223ad4e14e3c025739441987cf473585aad0c3a47e86bc44c63d34a3eebed15bfa7b8c589717a54ddf74b1189eee471ad8a0ccacd56df031a
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/m/Fnncr:XDeM7iNEkgiOb31k1ECYJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

e013a6fa61b2f581ba75debae343a37b64b232a861f62fd94eb239811994e789N

generic

out.upx

generic