1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN

General

Target
1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN
Size 83KB
Sample241110-byk75awkaz
SHA256 1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90a
MD5 4bc24c9ba5525617cd726f8ca1971510
SHA1 ac4b0b6fd09aabe1036a8146d587003daf7e980b
SHA512 aa7fdcbbd477461cb2a77515c8a41806f1602103253fe0959fafda7f416086f81a02631c3e99eb1023e57cb5acd9a5befb348f83ecc71bfb346d102bed2ae571
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN
unpack001/out.upx

File Explorer

1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN

.exe 83KB
out.upx

.exe 135KB

1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN

SHA256 1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90a
MD5 4bc24c9ba5525617cd726f8ca1971510
SHA1 ac4b0b6fd09aabe1036a8146d587003daf7e980b
SHA512 aa7fdcbbd477461cb2a77515c8a41806f1602103253fe0959fafda7f416086f81a02631c3e99eb1023e57cb5acd9a5befb348f83ecc71bfb346d102bed2ae571
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 9fa323c343f337d7a7bb4b8a463ec20fe123623f23e1b7fac9b5e3c15dfd18ad
MD5 40d243222d4fa3d3eff4dfa9c66249c8
SHA1 29e89f30b849f27b277fc57a4b7ca63547ae7b39
SHA512 b1927cf66c06bcd8634d3a9ad070738cf42fe89c92214914463951a0fd3ca7c6c4b1e0bb6cc2b75ccdc4e3cec4551c1758c951ad35ee8d44298ab0c5e1fe51dc
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/C/Fnncr:XDeM7iNEkgiOb31k1ECkJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

1c9f4d59ec4ae6f4bd9ecb79c431384869303a1e12c60e6d00afed26a015a90aN

generic

out.upx

generic