5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb

General

Target
5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb
Size 83KB
Sample241109-2kd5rstfkb
SHA256 5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb
MD5 f200fc195495a6e3657b671f6c7930e0
SHA1 1f8aa28ee80da7c8c8b534dcf1f40d95853d69b3
SHA512 e6e1a7beac9fe3c96b13388d9ba0867cffbb180fcf048e845f0a5c8817f25182990d159ea3ac195d09129386bdb5a6481d22a83bfde79af2c38874a0ebb0c089
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+5K:LJ0TAz6Mte4A+aaZx8EnCGVu5
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb
unpack001/out.upx

File Explorer

5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb

.exe 83KB
out.upx

.exe 135KB

5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb

SHA256 5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb
MD5 f200fc195495a6e3657b671f6c7930e0
SHA1 1f8aa28ee80da7c8c8b534dcf1f40d95853d69b3
SHA512 e6e1a7beac9fe3c96b13388d9ba0867cffbb180fcf048e845f0a5c8817f25182990d159ea3ac195d09129386bdb5a6481d22a83bfde79af2c38874a0ebb0c089
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+5K:LJ0TAz6Mte4A+aaZx8EnCGVu5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 ba4cdb3d9271d70cfbe3692235dd2fbd23276c019507244001a0b53d25772e20
MD5 17d2cd8a00cf6647a63964779eb6f911
SHA1 15b9dfbe0f61708021d699990da8bb85c14bf4c1
SHA512 0c046bf4ec71f0fb746713a0a49f5133cff84a56aa75c32ba4a3527a4100250b897bad8dfc3753ab7c17ef6a827d07989ad716b548c8845d2eef18e798d5e12d
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/U/Fnncr:XDeM7iNEkgiOb31k1ECCJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

5be776a8cbc77c9277b8d5e8e7e3bab5a98ccc786e81e5da5c83cc4d3de4badb

generic

out.upx

generic