b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N

General

Target
b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N
Size 83KB
Sample241109-2nbh2stfpf
SHA256 b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720
MD5 35f8024c19b0902c9b4d26f78995ce00
SHA1 2977bdb07548e0de3e289e3287b336847358bb27
SHA512 c4cc15ff5bf26fd3bd73d15837b2e1949e4336a9f000208769a0824f1e258b1673fc74663e04236b8ee2167b4f956c825022d3b5c22f4b34aa2d081559a67b32
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+SK:LJ0TAz6Mte4A+aaZx8EnCGVuS
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N
unpack001/out.upx

File Explorer

b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N

.exe 83KB
out.upx

.exe 135KB

b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N

SHA256 b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720
MD5 35f8024c19b0902c9b4d26f78995ce00
SHA1 2977bdb07548e0de3e289e3287b336847358bb27
SHA512 c4cc15ff5bf26fd3bd73d15837b2e1949e4336a9f000208769a0824f1e258b1673fc74663e04236b8ee2167b4f956c825022d3b5c22f4b34aa2d081559a67b32
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+SK:LJ0TAz6Mte4A+aaZx8EnCGVuS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 9eecb651539f37aa4b334b103d4dabcbbc5f45191293c6c3d75c9df8eae25f53
MD5 2427cf9de386d41c955d5e333400fb8f
SHA1 e6e7b65d486373c954aad3af4c1604d055498ce7
SHA512 3a9b7169203471d8ee3403c5b7da9d175a4d18211014535b44278e30406352b392354489ed29153b37f4972960d4aed8d6fc7c3aa35907ec9b40e580588882ec
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/T/Fnncr:XDeM7iNEkgiOb31k1ECTJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

b2c76380751e73d8178b5b4699e684965d8c1a1c9dc5b80bea9441f1138df720N

generic

out.upx

generic