e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N

General

Target
e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N
Size 83KB
Sample241107-raba1stdje
SHA256 e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7
MD5 3d4f8bad084dc96871bd2fa5f56e6860
SHA1 8e62cee44ca16644e54cafd164789043acccd680
SHA512 17ff71d6d5f30cb9b029819ddb75a8f2efd6d132ea1a7e36a792e09d168227a7621c5f8ac2d0954731753cb0581d5dc234b501e6238bd096203b2d7b37d2b86f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:LJ0TAz6Mte4A+aaZx8EnCGVuQ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N
unpack001/out.upx

File Explorer

e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N

.exe 83KB
out.upx

.exe 135KB

e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N

SHA256 e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7
MD5 3d4f8bad084dc96871bd2fa5f56e6860
SHA1 8e62cee44ca16644e54cafd164789043acccd680
SHA512 17ff71d6d5f30cb9b029819ddb75a8f2efd6d132ea1a7e36a792e09d168227a7621c5f8ac2d0954731753cb0581d5dc234b501e6238bd096203b2d7b37d2b86f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:LJ0TAz6Mte4A+aaZx8EnCGVuQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 298c9f3e5bdb8d74816bbe3333f8359b630af3dfd1ace2770f754b3cce1ae45a
MD5 c3ad68188f2ab1349b5917726f71d8e8
SHA1 f10277ca73603d1af87a827635c85e6fe2c93daa
SHA512 3723da1744824e50f3e1a37b9d93017f70cf13c3951330268262aa4b5e77d2cc8ee9723bc20484b3b71d285201fbf633be2ce2bea92c7327a425efa76e2f1670
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/Fnncr:XDeM7iNEkgiOb31k1ECJJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

e699797b99064f9526633869cffc469b1de89a7649f0be032bdf4a2c27e48ab7N

generic

out.upx

generic