806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N

General

Target
806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N
Size 83KB
Sample241109-xd334ayphy
SHA256 806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331
MD5 4ed945bbcdb4a8398aacdf03a4175020
SHA1 86ffdbb2de9fa8d415155a57fa83b5af7ca65667
SHA512 1c8962535e59fd4317058852556da9a60ed395ab35c53c63240ae1e9b4bded818bef7d9b4af60a2daab6d508ab07f3a2e96563bafc4e50a09b506ac89177c3c2
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+ZK:LJ0TAz6Mte4A+aaZx8EnCGVuZ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N
unpack001/out.upx

File Explorer

806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N

.exe 83KB
out.upx

.exe 135KB

806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N

SHA256 806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331
MD5 4ed945bbcdb4a8398aacdf03a4175020
SHA1 86ffdbb2de9fa8d415155a57fa83b5af7ca65667
SHA512 1c8962535e59fd4317058852556da9a60ed395ab35c53c63240ae1e9b4bded818bef7d9b4af60a2daab6d508ab07f3a2e96563bafc4e50a09b506ac89177c3c2
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+ZK:LJ0TAz6Mte4A+aaZx8EnCGVuZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 d6b58e4f1de5dd7f3aff9377d69bb9ece7355ea31b2de6f420ebd2d0f032c0fb
MD5 baca03ad55ffb057919c4d1b080ecb1b
SHA1 8635624b2a379bfd83e7245bca50ee6493529aca
SHA512 8c631e1067ea0b48ba3b1e4409e6e3adb1d7383cefa6418e0733c545a51f8dffa30890b566c7bb6a9e9052348a679742734b24e8c66bfbb36523bd746d48d5fa
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/0/Fnncr:XDeM7iNEkgiOb31k1ECCJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

806be7a684afb9dcd655afba75892469e4f9f2314f918751f91d175e01a4a331N

generic

out.upx

generic