c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN

General

Target
c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN
Size 83KB
Sample241109-2gstrawphr
SHA256 c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453a
MD5 953da09af16abb0e0130d6f6ded72800
SHA1 7583254f0918587c38a98a5c400a622828879f9e
SHA512 3d8c2df231ee12b971cab243a4de61a67141003a9cbe91c95445f84fceaa9f4e9017771200891a36ff7a91832f8678acef7550629f3f88cc2c924a8780997e5b
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN
unpack001/out.upx

File Explorer

c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN

.exe 83KB
out.upx

.exe 135KB

c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN

SHA256 c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453a
MD5 953da09af16abb0e0130d6f6ded72800
SHA1 7583254f0918587c38a98a5c400a622828879f9e
SHA512 3d8c2df231ee12b971cab243a4de61a67141003a9cbe91c95445f84fceaa9f4e9017771200891a36ff7a91832f8678acef7550629f3f88cc2c924a8780997e5b
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+2K:LJ0TAz6Mte4A+aaZx8EnCGVu2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 dcd1f3db2d551b9754026a2b741149127e6749149355a2deec0a610105a05f4c
MD5 968b73d614d73bf0eb493d77fd84d12a
SHA1 a4ca2fb2d78e3044581ce3f4431bb5f003a8c44f
SHA512 d35ca01c50de5aa07bc9075ed9c4fccc80446de655c7c4699dac49e34b491e1ec88d72463f1dd9f809514b50e8059bd29a12598d41a85042f2649218caddafe7
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/j/Fnncr:XDeM7iNEkgiOb31k1ECjJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

c240aa3218325dea16c4bf73dda3ac97df8044a04e57787899e82f14a9cf453aN

generic

out.upx

generic