4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN

General

Target
4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN
Size 83KB
Sample241107-sdctpavbjr
SHA256 4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0d
MD5 a4ed56dc6659e1c8a1f7716d6fa05b40
SHA1 1c7155da324594f37069e8e3c4d5a2e8081e4791
SHA512 58062e1cb8f13658e3c6376a0a39d2bf195b5a5d9b2e8d414c5ba81222b720199d4b3d82140f07650beaba0f4bed760dd6958cb970fdf9aa61ae6a6116d612ac
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN
unpack001/out.upx

File Explorer

4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN

.exe 83KB
out.upx

.exe 135KB

4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN

SHA256 4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0d
MD5 a4ed56dc6659e1c8a1f7716d6fa05b40
SHA1 1c7155da324594f37069e8e3c4d5a2e8081e4791
SHA512 58062e1cb8f13658e3c6376a0a39d2bf195b5a5d9b2e8d414c5ba81222b720199d4b3d82140f07650beaba0f4bed760dd6958cb970fdf9aa61ae6a6116d612ac
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+eK:LJ0TAz6Mte4A+aaZx8EnCGVue
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 56f79691d53cc1eca2ee9b72f8dc18cab621e1a9773399679b10c06d934023be
MD5 c59e3fbdf61a135297effd5ded74aa5c
SHA1 c93f5e92651a36af5a1b4db4394fafe65edbbcc9
SHA512 9d1c0c16700c18bfcda4f407098e05da62e0b73e68628e4df252ba529f40a989829f9173fdae7803eb42c7edfb55d551c2021f392351b7fc90f8dd3f7833ac23
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/n/Fnncr:XDeM7iNEkgiOb31k1ECXJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

4ebb5e4930a0df1499aef61e18c4406764e774acf6eb3dc10b10a0d1515a4e0dN

generic

out.upx

generic