5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465

General

Target
5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465
Size 83KB
Sample241109-2b258sspfs
SHA256 5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465
MD5 2e6142c283ebdc2d37475a66bd920c47
SHA1 32c5a0fbba62d0c9d0f2c763e5bd28a4f5891b3e
SHA512 fbfa0c7fbc8c987eb85b001e4e18913815cc960ee0ffed7d10871a60175611f90fffbf6c10af4bd7ebb473d0f9f2355b809cbbeeecd947b749cb9061a1d23711
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:LJ0TAz6Mte4A+aaZx8EnCGVuF
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465
unpack001/out.upx

File Explorer

5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465

.exe 83KB
out.upx

.exe 135KB

5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465

SHA256 5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465
MD5 2e6142c283ebdc2d37475a66bd920c47
SHA1 32c5a0fbba62d0c9d0f2c763e5bd28a4f5891b3e
SHA512 fbfa0c7fbc8c987eb85b001e4e18913815cc960ee0ffed7d10871a60175611f90fffbf6c10af4bd7ebb473d0f9f2355b809cbbeeecd947b749cb9061a1d23711
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:LJ0TAz6Mte4A+aaZx8EnCGVuF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 da0cd82ac0c9a37c877da242c3a976c456648575e4e53ee1d1b5fc52c57b1941
MD5 c04d4020bef16113053fcb9025df720a
SHA1 7c524915c8bb5c35c92478f9ed8162cf934fff4f
SHA512 70c18f280113bb6c3f6c6617e3fbf357bf2159af3fb8f56aff32fbfe27f41bad710e0efa97a192f8e7e4d81150a77aa465ce5604ad5e3b381ac0adbcee17c401
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/Fnncr:XDeM7iNEkgiOb31k1ECiJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

5665ef69e423acfbc3dd84ed2e307a65d375a392fc6c27406a6be0d6b621b465

generic

out.upx

generic