9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043

resource	yara_rule
sample	upx

resource
unpack001/out.upx

resource
9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043

SHA256 9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043
MD5 a27638448974fdb444557035e9414f55
SHA1 80728729b1aa1c72d8668b307b84585b71d6c82f
SHA512 d2bed79c5bee091df36bb7e75cb5a5701730e6d0c5d59d9b9e59263b5a06a611e08dca800b862863d0fc1c1229c8372003e691505bfa1f44959007fc6141ff6b
SSDEEP 1536:w0wWesg4fp0rn/iBs5mrgJU5FNYEQ+1ve9zWgIQ3jYYjuVLqVOsVxZNqRazZuqx8:w0NI4hgn/iBcFO575xe9ygxjQVG1jZNS
TLSH
T165A3F1023E187A07DE468C35B55B9C3226F47B8F2E9C5B1F61FD4F9E6A11BA05D0290A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9f:d9:76:9b:44:08:ee:a6:5e:3f:87:bd:5f:92:fb:ca:ca:24:b0:1b:63:a9:9f:8d:66:04:ff:36:f0:7f:bd:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=www.ccho.cc,1.2.840.113549.1.9.1=#130b7777772e6363686f2e6363

Chains

May 29, 2026

CN=www.ccho.cc,1.2.840.113549.1.9.1=#130b7777772e6363686f2e6363

PE Signature issue

Digest

d4:3e:6e:c2:b3:1f:9e:15:6d:9d:18:a3:5d:2e:06:2d:2f:2a:19:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=www.ccho.cc,1.2.840.113549.1.9.1=#130b7777772e6363686f2e6363

Chains

May 29, 2026

CN=www.ccho.cc,1.2.840.113549.1.9.1=#130b7777772e6363686f2e6363

Minor OS version

0

Major OS version

4

Entry point

3408704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

.rsrc/1033/GROUP_ICON/103

SHA256 61bbaa1c6e8c1689b2c7f096eb03902c5a5f0031db20828da8a45ca45ca6dbce
MD5 29134a1bb16b9f08d14c6f977f256368
SHA1 272c4d16d440f2709eb8eab9790bb7b06e6a55bc
SHA512 58aa83209bfce3db64f691b7edd0fe127f892fa9bdd2c1361a30476c708675e4db4c78d0f0ad2908f8f078866bffee3605300c778e6be08e07ed732793dc0f43
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/1.ico

SHA256 a72a3714d538f2c279db59528465d7bed76d88b154337b10c9be96daed9fcdf0
MD5 ff5e1d34cee7df3c0bee59b46e0be3a3
SHA1 cf2844d2da3042f2cf1e6cc39b1fbbf90d4aab3b
SHA512 1512f233a09e2b6f56604a82d8dc38dd380317221ba149d75b63231ce77e1b3ee9f51e7b5931e2d6e1c86252bb216d4475f65c4887f3a3dbb90d092d9fe3a582
SSDEEP 96:Lu34dqzuMcszHGYBurWBpox9CCyGZto7DZKqJ2Desk1fZ6KPIacHN0XZ4UUTZq4C:I4dI3HGPWBa9CJmV7Desk1B7PIuR74C
TLSH
T162124C06B9A5F5B5D301CD34D924A8FA62243862465C715F19B43E4FA7F71B7002678F
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/MANIFEST/1

SHA256 7737bea785028e74f59b16c2507df38f4b53fdb645ba83e8358b9c6dae7d20cf
MD5 f1ad3d24615cbac7ca24446a2f50977d
SHA1 735729c60d20293009519237b7fba52ae085b133
SHA512 2bb8bf12169e25748db9bc3c05e822c9d81398843bdb07a2fdffa7ffa8dfa612c2ac1ccc948daeee13c8a6c56995274bda9c77ea0973af3e9fbf86ae08040a3b
TLSH
T107114281D424E566E71202E73FB8F549157AA33B08CC4BEDC4C59B7DB202A8B87221A1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/2052/version.txt

SHA256 927310bc1ac001669ab5eced067e80b6d5bc43e1895f5a557bc9ff83851f0e14
MD5 897ebbf5b5258d52fc548d0d02abe9e6
SHA1 a10037a50f897e8b6e17cc7537daeeec978938d2
SHA512 1fd6c46bd620341afaffd580e334d04e1c98964a5d1e46ed994c40905a988824b67c7e554af68df08b06fcec9381dc35ae42dccc6b9980da4f4058525c3c9b98
TLSH
T19611E10A95FB3298A0A7B58E8EDA987257433D14483DA25EA9CD7F4D0FD34011D02BF7
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

CERTIFICATE

SHA256 fe1efc52ff1d6132d9511adc75966cf9cf3aa18ea1dad5b91308430a1c2a8046
MD5 0f64abd022ec84f55a479f765716913a
SHA1 6c8596274220229d4aebfe44cb48d39b1eaaff49
SHA512 5a43b88ea3025441aef47069aba1ef6ffc464a2c55c8a5facceb76a0f68936d7709de31e00ecc9da66d8e63b1422f006e8c91f7274668d259bcee0d2051306d3
SSDEEP 192:EiBGOPPAMXHrLY0GcPmyTyOkO5EiCAUOXEsJKRBGBGOPPAMXHrL40ZdmyTyOkO5w:bLL/B95rrXTKRBoLL3B95rrXTK/BiK
TLSH
T109422C5B4F3DB942BE86DD18E6DC48730D71BBC818A59D0E357641992E217F0BD8C82E
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 3ff3b98fd29a5562086b2962be0d9f7e40a5264906a74cfc72130df2e6205b96
MD5 3b77d1898ccf496e70e4e2c97b532ee0
SHA1 ac00fc7ea6d336040be925a91b96f4db0baa8647
SHA512 e2f7aa2e59332b72b01aa6335fd8452b863396ece1849c699b6241ceed86b976e741e964c38a69dbd939a039ae17eedf21956a4ca517fd80264314d19d6eef8c
SSDEEP 384:D9V7QX1PbYglLXIzdtS6TKFHJePjQaMfb66xFijUbW+tizBzLLLLLLLLLf0Gp:D9eX10WLXWdtS6WFErbvY4j+jilzLLL0
TLSH
T1FBA2BF6535852F1DCC622AB5720B6F3023F1971F3EA82A1EECFE8BB760599000B5344A
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

[0]

SHA256 0288951f4d2c4db55baf3a9acf5fc86bc2d88aa21299830cc6d13cca6abb5033
MD5 640b8ca7e1f243f17a747fa2ae49729a
SHA1 2e7b341975c79e55afc537d37473ce705579b100
SHA512 4822316123f83e77f77fe4f8829fae9787a87c9358e877e7a7a31ad68b077ac64e70a281644cdba65b46427ce6b65faac5420a34454fce057c27260b3fd5cbc3
SSDEEP 1536:7rgJU5FNYEQ+1ve9zWgIQ3jYYjuVLqVOsVxZNqRaP:AO575xe9ygxjQVG1jZNqc
TLSH
T1EE23F1413C45B017CA9D8C4B381BE83A78ED19CFFACC6A7F825D4F6CE545EA69542E02
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 0221bc196af36b2bb92802957e9acf655d337a50f466f9deb9a47568b8ff4d0d
MD5 32b5a97b9072b3e7d3f4d27578636ed1
SHA1 776f35cc0b6c51579107d229ebe37ad22f63b2f4
SHA512 d1f8928c745452817056a8642cf51b51de140785e12240423b8a52939b832b72364bd11556b89bb1a21cc7fbd9793d9e3c286b5c8607b7326f8498116a48b09e
SSDEEP 768:1lLKD/2FF8HgxVfgwz41zb+6zVgctSdAa34Suldt/Ti1BsM741:1BKDe7Zdgwz+rS3Huln/iBs5
TLSH
T1A9438D10B3B0D433D7725B705E7AE677AFF6653201A8A70B13606F2E7863A49D80E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths