6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N

General

Target
6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N
Size 83KB
Sample241107-sg5zmsvbng
SHA256 6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387
MD5 55449e2537f20bd3862741d6a64580d0
SHA1 932588a0cd22a37b60075f293fbca1f61c44ece2
SHA512 e91c5661d2e72240b29702b89d5757143107525e1bd5bd60283942b0674c12797934acb651282e987bf99ec5d6e641822d77bd23274b6e0931090cc153d6e43f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N
unpack001/out.upx

File Explorer

6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N

.exe 83KB
out.upx

.exe 135KB

6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N

SHA256 6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387
MD5 55449e2537f20bd3862741d6a64580d0
SHA1 932588a0cd22a37b60075f293fbca1f61c44ece2
SHA512 e91c5661d2e72240b29702b89d5757143107525e1bd5bd60283942b0674c12797934acb651282e987bf99ec5d6e641822d77bd23274b6e0931090cc153d6e43f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 36c7637d9a95317f874aeb0d0c4c4e357c21b76d6d95dd7549aee606b338e487
MD5 dcaf0aff4326e7cbb92e4f3cb0e845a3
SHA1 41a401a0674b438a2185d0a3fa88ca91e056b382
SHA512 9bb3eaf632c06eb9f0c38ae560eb3ad9b297c30f731bdef03902c14111b33c4d09a16e5195601b1060ae67f7eb5e737639d2e4b5a7e0dc01a4158ee4ad3fb8ed
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/s/Fnncr:XDeM7iNEkgiOb31k1EC6J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

6402772756d25c6364506929f259e5835630ae33b175c9847c6c20d4d56a9387N

generic

out.upx

generic