5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a

General

Target
5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a
Size 83KB
Sample241109-2lpynatfll
SHA256 5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a
MD5 ea12ed971119af3e331ebb110b2014f2
SHA1 426442d9a0dc9ad897e5252d5930df52ac589508
SHA512 0a90c5e13ab94a9cbdb82e5ef868e6aae8a4b9a77f95d9fd56e82535c184698adee2ed860c28853960086b9827f4cfb8f6e69cd64f7cf92c1443b9aef7af80a7
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a
unpack001/out.upx

File Explorer

5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a

.exe 83KB
out.upx

.exe 135KB

5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a

SHA256 5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a
MD5 ea12ed971119af3e331ebb110b2014f2
SHA1 426442d9a0dc9ad897e5252d5930df52ac589508
SHA512 0a90c5e13ab94a9cbdb82e5ef868e6aae8a4b9a77f95d9fd56e82535c184698adee2ed860c28853960086b9827f4cfb8f6e69cd64f7cf92c1443b9aef7af80a7
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+VK:LJ0TAz6Mte4A+aaZx8EnCGVuV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 f4f87a612fd3d45de9f036e7eff99b84f02406715abe0723ba98b23eef36ef6c
MD5 aa154a157cc3db9d5cca5b19ca5d3baf
SHA1 cf5649e7a976edd12654fccb743c294bcbf02c95
SHA512 632027eb4ad22c8a7a34878cd29f069b98e15110d828f6c61ea737ec49589ee4392e1b178f10e0b2bfb1d025f13aa3196761b251c116eeda3e99e1339f8e35e9
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Y/Fnncr:XDeM7iNEkgiOb31k1EC2J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

5c729996b85d3f1aafeaab7758c1eda98dd7a060c6d54f054a0eb7200e28e04a

generic

out.upx

generic