b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3

General

Target
b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3
Size 83KB
Sample241110-chqcksxbml
SHA256 b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3
MD5 e1d31129c573f22ff64e10f62fcd71ee
SHA1 61a2ddbe73d8755a0e8ce4039bdad7ef7d54e631
SHA512 381c139cd25dc0f36ed8e2c6cab3fff91248bd07882d5ef3f25fa01ea66f43095487a78eea928190a5ecf7affba9516960aefea5aaf741554b2956ab33074dd4
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3
unpack001/out.upx

File Explorer

b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3

.exe 83KB
out.upx

.exe 135KB

b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3

SHA256 b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3
MD5 e1d31129c573f22ff64e10f62fcd71ee
SHA1 61a2ddbe73d8755a0e8ce4039bdad7ef7d54e631
SHA512 381c139cd25dc0f36ed8e2c6cab3fff91248bd07882d5ef3f25fa01ea66f43095487a78eea928190a5ecf7affba9516960aefea5aaf741554b2956ab33074dd4
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:LJ0TAz6Mte4A+aaZx8EnCGVuv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 40857b618936164f30e2a3a3cc5c2fae9eb904c460003f5a39697900de0a20ac
MD5 0ea321e0b7edfe8c8fb692e908f2dfde
SHA1 787c9f73188bec610756ae6088c49b0fa201ef70
SHA512 0d75d92659b98b94f0e931f75237eb0e8d6c6f4acaabaaea7d1342e71bb2a34e41b8a8938e0e44d69d0bfa45c0e3c4d1451ab19afc554a2bc007d6ee7d5f3567
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/2/Fnncr:XDeM7iNEkgiOb31k1ECYJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

b8e6e4429a00e63da4fc405154508076842ab70fb43b360d2474de1b86800de3

generic

out.upx

generic