a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N

General

Target
a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N
Size 83KB
Sample241109-3te9vsvdjn
SHA256 a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097
MD5 029898eb42db2b41d8e08e37ede7a240
SHA1 687dd6f156b9275f64eb854a75a6be854fca1031
SHA512 1954764b7fe76bcfca4b2c3c52213544ec66530a92b3232360a22e99e6e29140a6fd3ccecc732a8584d032c2f1200e4db6578cca2cd89badf47a104117125414
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+8K:LJ0TAz6Mte4A+aaZx8EnCGVu8
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N
unpack001/out.upx

File Explorer

a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N

.exe 83KB
out.upx

.exe 135KB

a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N

SHA256 a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097
MD5 029898eb42db2b41d8e08e37ede7a240
SHA1 687dd6f156b9275f64eb854a75a6be854fca1031
SHA512 1954764b7fe76bcfca4b2c3c52213544ec66530a92b3232360a22e99e6e29140a6fd3ccecc732a8584d032c2f1200e4db6578cca2cd89badf47a104117125414
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+8K:LJ0TAz6Mte4A+aaZx8EnCGVu8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 f62555e0b71ef081c4900d5c8d2afe47a0b87e7f9ba92a5bfc87be199abb9ae1
MD5 16897f527f831429f4b1d55380a7ceb7
SHA1 27ea429317918c03c37d17fffa7ceb2feddf6581
SHA512 ded8a83dcccd7b1e2cf28268c6830ed66054d0d9b2575a98592f3bd144d6b42db9ddf129d970f786423f3064538b3f388d355806517e4c0a5a34572bcbf18f30
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Z/Fnncr:XDeM7iNEkgiOb31k1ECVJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

a8fee98e488582a351d0f86f36eac2f15dd927db5e31426dfde277824f954097N

generic

out.upx

generic