e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N

General

Target
e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N
Size 83KB
Sample241110-bftfsawdkj
SHA256 e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048
MD5 8fd528ae06093a43ed475e13a0b64970
SHA1 a27aec94f59f34804fa98fbbbe80a4bfdb38e8e2
SHA512 5cf7314661c2351202feada9e4c11f7e12b56c50a1e28c398c6f3350cdcb14dfaab45cafb14726cd8385beea26b835f602192ba4c38aa836716ca72b0f86851f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N
unpack001/out.upx

File Explorer

e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N

.exe 83KB
out.upx

.exe 135KB

e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N

SHA256 e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048
MD5 8fd528ae06093a43ed475e13a0b64970
SHA1 a27aec94f59f34804fa98fbbbe80a4bfdb38e8e2
SHA512 5cf7314661c2351202feada9e4c11f7e12b56c50a1e28c398c6f3350cdcb14dfaab45cafb14726cd8385beea26b835f602192ba4c38aa836716ca72b0f86851f
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+dK:LJ0TAz6Mte4A+aaZx8EnCGVud
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 9866f328835d70b2d1475d68640770f7319d479f1a929c4d5a7b7117d22e280e
MD5 df64e404f553901c2b19dd15c8e1e892
SHA1 17d501c1c0bfbcfeae52af55af9ac5886a20bad0
SHA512 57fcafef5112a9cf03649a8d0b818c6e4678f6c66b4140aa048798af976e4065eb26ecc7aff069aa19e0eafd8cf5c50984ce5f9be967dd94c045ebb8271f23f5
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/M/Fnncr:XDeM7iNEkgiOb31k1EC6J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

e6148c2c7d0c9090fd3b19e03e430c21efbe5c32e555ad6c0473bb4caab3f048N

generic

out.upx

generic