28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf

Sharing

Copy URL Twitter E-mail

General

Target
28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf
Size 3.9MB
Sample260801-ezb8dsxfpc
SHA256 28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf
MD5 9ccb577bc988e429c54d7fff67b26831
SHA1 a36165ecbcbf7762c27d6e438d16a3a3a3b80b98
SHA512 7c97a1b40cc178e1decca10be35162dc00aac4c583f5462af7234f968b03c7c6317ccaa66df0671f2d71b96ac18a8f3f4d866e0ec2f1d8247c68ff81ebc78a2f
SSDEEP 49152:d6I78oJFclgj9xvDcechTXU8QX7zBa/yDcnm8Sc2nIPnGz0+114wjLgquw2PeoVG:h8wAgj9m7EFfcpSjfZgJNJxs6
TLSH
T1141633835FF41427E43C3CF61E1F28F8677221E464678FBB6B6656E024CA322E623655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf

File Explorer

28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf

.exe 3.9MB

28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf

IMPHASH 4246c1f14d56f426ab90fa52c226f7ca
SHA256 28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf
MD5 9ccb577bc988e429c54d7fff67b26831
SHA1 a36165ecbcbf7762c27d6e438d16a3a3a3b80b98
SHA512 7c97a1b40cc178e1decca10be35162dc00aac4c583f5462af7234f968b03c7c6317ccaa66df0671f2d71b96ac18a8f3f4d866e0ec2f1d8247c68ff81ebc78a2f
SSDEEP 49152:d6I78oJFclgj9xvDcechTXU8QX7zBa/yDcnm8Sc2nIPnGz0+114wjLgquw2PeoVG:h8wAgj9m7EFfcpSjfZgJNJxs6
TLSH
T1141633835FF41427E43C3CF61E1F28F8677221E464678FBB6B6656E024CA322E623655
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11865495

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.itext

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

83KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

88B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX0

Size

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX1

Size

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE

Name

.vmp1

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

28716088fbaaa1875e4ad0b75e38807db2de08371e5e02ee0c083fd534f02daf

oleaut32

advapi32

user32

kernel32

gdi32

version

mpr

ole32

comctl32

shell32

comdlg32

wsock32

gdiplus

logintooldll

generic