473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N

General

Target
473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N
Size 83KB
Sample241109-2g6qlsterb
SHA256 473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823
MD5 ad50b80f282211314a1832bd9a8cd6c0
SHA1 6b040792290d72d838c6ca62d82f7ea526edbbcf
SHA512 c303219fd198d2dff7c3766a5525724e7734f9e7abf126d9167921c2d06fc152491ad4a399cdc8d0eb14756e6d9558905ee5e4577caffcdd9f37fd5796ce504b
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N
unpack001/out.upx

File Explorer

473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N

.exe 83KB
out.upx

.exe 135KB

473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N

SHA256 473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823
MD5 ad50b80f282211314a1832bd9a8cd6c0
SHA1 6b040792290d72d838c6ca62d82f7ea526edbbcf
SHA512 c303219fd198d2dff7c3766a5525724e7734f9e7abf126d9167921c2d06fc152491ad4a399cdc8d0eb14756e6d9558905ee5e4577caffcdd9f37fd5796ce504b
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:LJ0TAz6Mte4A+aaZx8EnCGVuN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 b0a1205bf7833910603f8b537d073847a29f6409c93ec17d88783772d5091825
MD5 54e5c63176813d4271d17cd4089e62cc
SHA1 dc7f1d6e7f17b7bff2a699aa3182e9af4f4c7ff9
SHA512 212b88fc5ab7044e19767252781f7dd5b52730c07ed44706e51680a27029117595f565934f4474a284357e64d6ad1741d78aec3638533621a524cb7bc2ff0988
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/s/Fnncr:XDeM7iNEkgiOb31k1ECKJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

473cdaeb054ff61f839d71fd713d21a6e92e2da1b6ad31414834dbf2b39d2823N

generic

out.upx

generic