dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59

General

Target
dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59
Size 1.9MB
Sample260715-v79fvsdx2w
SHA256 dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59
MD5 a6d2fb8459e916f4f608b67d371b8a6b
SHA1 f49c5fd71bc118685b389c08484c7a7f4bd4f5d8
SHA512 2eb21e319b6945487e752a0fb60f5166cb96ac7c6477708319018c69880ffc78119d8fe1ae0886abeb665c55f29794ca754060e5872c021db0cfc74277fa8d1a
SSDEEP 49152:Oq7kwk57k599qO4wab2BggUSuzG87zzGafVx:lI9U9q9wabOghJ7zzG6
TLSH
T17F9533D5113A5604E88B74B4D22EFD612208FC2C899947A337BBFE4AFD30B6A0755277
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59
unpack001/out.upx

File Explorer

dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59

.exe 1.9MB
out.upx

.exe 5.0MB

dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59

SHA256 dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59
MD5 a6d2fb8459e916f4f608b67d371b8a6b
SHA1 f49c5fd71bc118685b389c08484c7a7f4bd4f5d8
SHA512 2eb21e319b6945487e752a0fb60f5166cb96ac7c6477708319018c69880ffc78119d8fe1ae0886abeb665c55f29794ca754060e5872c021db0cfc74277fa8d1a
SSDEEP 49152:Oq7kwk57k599qO4wab2BggUSuzG87zzGafVx:lI9U9q9wabOghJ7zzG6
TLSH
T17F9533D5113A5604E88B74B4D22EFD612208FC2C899947A337BBFE4AFD30B6A0755277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5519088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=584, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 29c8bb87fb08c7b1cffe08e4e2c3d7d0d08ec3b14d42740161b9121fadc64df1
MD5 6e02d5134715918968f41a42da507aa2
SHA1 4087938a97131c2438c323c5e1200b643a2c98fa
SHA512 9b281b2a00378528550a908b547771b1856fdae7af0ed12cdae62786246579beb07a6ab4e965044f4dd2f503e651724d742a7e24a0e7e9f46a3159a14d2454bd
SSDEEP 98304:QffdLnahS1qhvR2qzOfJJA8U7dSOsBhjMJ9gfU:KLnG/vR2qRdSyJ9Y
TLSH
T14036BF11FA808072E5A3413482BAAB7B997DBD201734C5C763E42D7A4E716D1BB3E35B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

778707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

693KB

Virtual Size

693KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

111KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=584, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59

generic

out.upx

generic