80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6

General

Target
80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6
Size 83KB
Sample241109-3zf4catphs
SHA256 80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6
MD5 652f6ba4677fcd3e0621d8bbe9541b4b
SHA1 c983883d7ceb26e3842782d25c873fb6f63031ee
SHA512 ca14066c00c137f47efc01c0507be21579a41f2224821ac92385c8be172699ba7ed5137eddaa869bb3af65b698cf8d53330318d92c0429b0a6598b1d44fcc068
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+sK:LJ0TAz6Mte4A+aaZx8EnCGVus
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6
unpack001/out.upx

File Explorer

80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6

.exe 83KB
out.upx

.exe 135KB

80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6

SHA256 80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6
MD5 652f6ba4677fcd3e0621d8bbe9541b4b
SHA1 c983883d7ceb26e3842782d25c873fb6f63031ee
SHA512 ca14066c00c137f47efc01c0507be21579a41f2224821ac92385c8be172699ba7ed5137eddaa869bb3af65b698cf8d53330318d92c0429b0a6598b1d44fcc068
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+sK:LJ0TAz6Mte4A+aaZx8EnCGVus
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 1e428b5a0f1b5a9bd6966c5d37ed620a4fb448a93029eb52fab293a5ae2b25f1
MD5 82d41ee4d8ddd931545ecf2327e3e410
SHA1 c4dd2e2cb7aba78e108cdaaa81347011d6df5a0d
SHA512 fa8eade6fa3153ea804b40040f01f210d2f80afaad754ad207945fa446eab34bea9eb5fde451341757a54dcd7c51a5c3a084270bc9677bd0475e85419ffdbfbf
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/N/Fnncr:XDeM7iNEkgiOb31k1ECZJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

80ffc8d4bb610bf31673d2cf819889d325b80afe8102fe54d4a2f4eb111786d6

generic

out.upx

generic