6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N

General

Target
6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N
Size 83KB
Sample241110-e32bpazemg
SHA256 6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518
MD5 782c4193a5f5c46be9735f183cc4f790
SHA1 2b99ddc7d06b1c87307c3ada47d45535673b6a78
SHA512 8816533705ddc628ebff2c406a3393ee6fd7644d6a06359880385d1b85a6909282f25cd3956ba6912a8f976ef768b84ab6dceb90316fe7683ff05a22e631ff3d
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N
unpack001/out.upx

File Explorer

6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N

.exe 83KB
out.upx

.exe 135KB

6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N

SHA256 6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518
MD5 782c4193a5f5c46be9735f183cc4f790
SHA1 2b99ddc7d06b1c87307c3ada47d45535673b6a78
SHA512 8816533705ddc628ebff2c406a3393ee6fd7644d6a06359880385d1b85a6909282f25cd3956ba6912a8f976ef768b84ab6dceb90316fe7683ff05a22e631ff3d
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+JK:LJ0TAz6Mte4A+aaZx8EnCGVuJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 21a8b57f9d2f17a781b1927c9c8ef54000092445d7f05d60583a6b52371771d7
MD5 b72ac2250920c89937b1438e89223bc3
SHA1 a82a968ced9dfc9492fc7c1a2cb8eab8deaae49c
SHA512 9c21a3a7978567e9e791e74eaee80d1e906eacabdcae95ef0d1b5824bde9e775fdf70ea72c46cab737a7f7bfc3e1e8f461c98a45bb4ade5d7136534d6f80f8f3
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/I/Fnncr:XDeM7iNEkgiOb31k1ECGJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

6ff90851958571ef36a370da7a5b6f8594cac303b8184fc4ef4e1d5a42960518N

generic

out.upx

generic