24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N

General

Target
24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N
Size 83KB
Sample241109-2bckkstejh
SHA256 24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065
MD5 8c9bc03e6e36a2aba38abe2cb8270120
SHA1 b936ee37c61f728310fe56a125cbe8f3faa16296
SHA512 e1a9f3e8e6d4605ba1a163530e67b4f14ba98ba18063bd2d3f4d567720b4f156ce4b0f26f6ee242163e7985ea65c15a174cca229a5f635490da8d6b0fe5c63bb
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N
unpack001/out.upx

File Explorer

24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N

.exe 83KB
out.upx

.exe 135KB

24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N

SHA256 24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065
MD5 8c9bc03e6e36a2aba38abe2cb8270120
SHA1 b936ee37c61f728310fe56a125cbe8f3faa16296
SHA512 e1a9f3e8e6d4605ba1a163530e67b4f14ba98ba18063bd2d3f4d567720b4f156ce4b0f26f6ee242163e7985ea65c15a174cca229a5f635490da8d6b0fe5c63bb
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 a306cfb42403d0da3063aa0cd17077d36c919b15444b9e4ff0207a8576449c93
MD5 95c0cad31e7d6df3cbaf139919a8b0a6
SHA1 324ab1deac5c1beb2e3d4567c4c56310f326a5df
SHA512 fe0149c7776a2e8ba4b2ad3e67b36d7bc6f8ad9c3e0aaa3f1e1c31a33d4c7821c3118192c1370882cd04c2415bc2f7d8b42add657f45663d32e1c15d53c63f5b
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/q/Fnncr:XDeM7iNEkgiOb31k1ECsJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

24cb67c280c3c4811a48f7494bc2fcd19aeff3346a2244b61e2e3d079df98065N

generic

out.upx

generic