2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N

General

Target
2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N
Size 83KB
Sample241109-qmkvjsvfnd
SHA256 2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1
MD5 9a70490bdf6b2ced49289c97e095e600
SHA1 33c15b3dc6a4d61c4ca4a2fb5e426e2348a251b4
SHA512 30aba944583648586b394d64b2f15a9041223ab5054e95b9349af9cf064a533a71f56dd8f868c06bf5404492739933458d46662e87bfc09b2bd40b3f911e9090
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N
unpack001/out.upx

File Explorer

2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N

.exe 83KB
out.upx

.exe 135KB

2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N

SHA256 2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1
MD5 9a70490bdf6b2ced49289c97e095e600
SHA1 33c15b3dc6a4d61c4ca4a2fb5e426e2348a251b4
SHA512 30aba944583648586b394d64b2f15a9041223ab5054e95b9349af9cf064a533a71f56dd8f868c06bf5404492739933458d46662e87bfc09b2bd40b3f911e9090
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:LJ0TAz6Mte4A+aaZx8EnCGVuA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 ae59416f97d3036e0c534cb940bee1ee62c4be4e6b28657d9f3320aea9755120
MD5 7c90358d319f162e3c33b9a2210169b3
SHA1 40e937092954565ee81275a1a35ec0a31d2869ef
SHA512 d319b7259c1d479ac600b233ef156ff28b411c18fbaa90be67a8333389372dee87c39d6773b81630b76348eb2f6d8f1050e0ef736eebf078cb129602fa5bd7c7
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/l/Fnncr:XDeM7iNEkgiOb31k1ECRJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

2f6e05e4d5074735c0714c2caa4f383e24ec15fbc0af6f54d06253c256dee6f1N

generic

out.upx

generic