f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3

General

Target
f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3
Size 83KB
Sample241110-e7zzeszflb
SHA256 f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3
MD5 8dc24bb8db2ae2e9487fcc76c29a7fd6
SHA1 36063d5cb1b892e8cd2a29c188b7abdfea84c9d1
SHA512 591a58184aea01d20c343df483b6ea66097edfdf2a5495ad7a25e7a987ab418f9168906b465e7685fe93d6d2ceaf4faa8763a434fb9f9c74d100343b519cad32
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+TK:LJ0TAz6Mte4A+aaZx8EnCGVuT
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3
unpack001/out.upx

File Explorer

f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3

.exe 83KB
out.upx

.exe 135KB

f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3

SHA256 f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3
MD5 8dc24bb8db2ae2e9487fcc76c29a7fd6
SHA1 36063d5cb1b892e8cd2a29c188b7abdfea84c9d1
SHA512 591a58184aea01d20c343df483b6ea66097edfdf2a5495ad7a25e7a987ab418f9168906b465e7685fe93d6d2ceaf4faa8763a434fb9f9c74d100343b519cad32
SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+TK:LJ0TAz6Mte4A+aaZx8EnCGVuT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 dd0a9b1e439e25e12308db29941a28d98a5ca58399b4663c6172aba1d305659c
MD5 37de3f1ef5bce862c8115a28692859b8
SHA1 80d0d3e92d56cf120a78dece814b08208535d65b
SHA512 1c6ec7c9978320c8fabab853a2bb4e8e771f49bdfaf921c3ed9134ce0a87a51bb116dcb10ce1014339008b5e4e6845b3381ce5c0b7fa52168afd2e35f45438af
SSDEEP 3072:Xs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/m/Fnncr:XDeM7iNEkgiOb31k1ECYJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

f92635dc0b978fc662fb01cae1f5788bde07d78a50284e5a723c76cc3f0cc7d3

generic

out.upx

generic