d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428

General

Target
d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428
Size 1.9MB
Sample260820-eexzcssshs
SHA256 d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428
MD5 84961599811c77d9da0eb0462c590d62
SHA1 78c6d3ac9f2acfc97a0d61c91601162b13278f89
SHA512 d0129e95c5954587399bb7b8d64b3c22be84a6934d0b1f559d59924c280869923ec795726b14c0f0acb860fd768723254a9b802f3c8899011982f3eb6664ab72
SSDEEP 49152:Ab2f68Q3Zhhck6QuuODW7YmfZhvzyPGz3+yhLmVsZd/d:dPQltuu8mfZhvWg3bhLmVsp
TLSH
T10E953341207A8C38F81388FDDF27AAA075609DA55C46586723B7FF4B9DBFAE907C4412
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428
unpack001/out.upx

File Explorer

d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428

.exe 1.9MB
out.upx

.exe 5.0MB

d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428

SHA256 d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428
MD5 84961599811c77d9da0eb0462c590d62
SHA1 78c6d3ac9f2acfc97a0d61c91601162b13278f89
SHA512 d0129e95c5954587399bb7b8d64b3c22be84a6934d0b1f559d59924c280869923ec795726b14c0f0acb860fd768723254a9b802f3c8899011982f3eb6664ab72
SSDEEP 49152:Ab2f68Q3Zhhck6QuuODW7YmfZhvzyPGz3+yhLmVsZd/d:dPQltuu8mfZhvWg3bhLmVsp
TLSH
T10E953341207A8C38F81388FDDF27AAA075609DA55C46586723B7FF4B9DBFAE907C4412
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5525504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=587, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 9dbde191ade61641e2bd104fd3d546a1f0117d7bcaf406c593678e2bc2919300
MD5 d28813f88887a2500c5a1ecaf95803c6
SHA1 78cc0ddec1bad4af43420db2d12cf899ac7a03cb
SHA512 6b03c8f91d251cf65a5e48b7c21bbc692e0d39205468a611b3185a392bfdd8152294e6784033b96ad5ef65febd4a196a1ad1421ade8b1180dd62471dea3258c1
SSDEEP 98304:t7RMfyn/ujjqP3nq7+rjhQdkOsBh+MJ9gfy:tGfy/uvqbidkHJ9Y
TLSH
T1D936CF02FB8040B1E5E3413581BA967B997DBD301724C6C7A3E42D7A4E316E27B3E75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

784520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

695KB

Virtual Size

695KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

111KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=587, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

d457a2fe8626b036d5f293405b03a3c93789ab9167d0044895569362519fd428

generic

out.upx

generic