7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN

General

Target
7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN
Size 83KB
Sample241109-2qvppstfql
SHA256 7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730d
MD5 00e125a02701000072156b9e9e505510
SHA1 e6825d1e8d318c6450c1b884824b90b6bcd0bf90
SHA512 9374b527f9c560df31f77f1ae519fe5b2f00e784ad8b76a6008114c082a6bac2c197a5679e8a1f84e73cd89e0e7029238029aef6d5cb35b59356cc909e3e305f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN
unpack001/out.upx

File Explorer

7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN

.exe 83KB
out.upx

.exe 135KB

7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN

SHA256 7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730d
MD5 00e125a02701000072156b9e9e505510
SHA1 e6825d1e8d318c6450c1b884824b90b6bcd0bf90
SHA512 9374b527f9c560df31f77f1ae519fe5b2f00e784ad8b76a6008114c082a6bac2c197a5679e8a1f84e73cd89e0e7029238029aef6d5cb35b59356cc909e3e305f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+PK:LJ0TAz6Mte4A+aaZx8EnCGVuP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 05c54b662c0c91f393f69748422a45280f5b67e9748fbcb63bd57ff5ff2900bc
MD5 b45c6d2397b9128ec4848edaa34b7b49
SHA1 fcddab7541b696ffeea5a55ddcfec24b34210fe2
SHA512 0cc25c889e7f0c9954eb0ac26ee742533a47e5c061e3b22bbca4a45fc998b2acd849c20ef659858981f5db52e580c82e1243299df25f29a4f26e9bdc46a33c0b
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/G/Fnncr:XDeM7iNEkgiOb31k1EC4J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

7f45e67cc89fe539d7d5993b4f42bfae5af08e2ce5b4cb965004bb957231730dN

generic

out.upx

generic