3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f

General

Target
3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f
Size 1.9MB
Sample260924-szr6hawbpb
SHA256 3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f
MD5 6640f47a8f292c4e48585fb48291036c
SHA1 757949e6951a8b049df4e3c60c00ce74e2dcdf82
SHA512 ec7c7ebddffd59dcb2d230e904c5699d1b8f539c1ba52fefb70d485c0aa8abf8015e4eea975df47c7f85f3fe442d4ab4e9e0098962ee9ca78ecd39eac9e52d8b
SSDEEP 49152:9xggETA3iiTHcf428asHGhQvt3ECtLtOPW5mCgJB2A1:9xgJAlwf83/S9PWmfJIA1
TLSH
T1589533C254AAE93EF2D3547AFA60D8C02609ED16045627E309BBFD1DBA31B9817D07D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f
unpack001/out.upx

File Explorer

3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f

.exe 1.9MB
out.upx

.exe 5.0MB

3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f

SHA256 3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f
MD5 6640f47a8f292c4e48585fb48291036c
SHA1 757949e6951a8b049df4e3c60c00ce74e2dcdf82
SHA512 ec7c7ebddffd59dcb2d230e904c5699d1b8f539c1ba52fefb70d485c0aa8abf8015e4eea975df47c7f85f3fe442d4ab4e9e0098962ee9ca78ecd39eac9e52d8b
SSDEEP 49152:9xggETA3iiTHcf428asHGhQvt3ECtLtOPW5mCgJB2A1:9xgJAlwf83/S9PWmfJIA1
TLSH
T1589533C254AAE93EF2D3547AFA60D8C02609ED16045627E309BBFD1DBA31B9817D07D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5530032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=587, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 3cc90a2504c8e8c49fa8d8d2f51964c8f23427164ceef4ed150d47dc778a5162
MD5 6cb93ce4d69de1d071d322d236623d52
SHA1 bbf73572942bb66244d8fb74c5655caa650a15b4
SHA512 9462cfefd8581e4c95640e88913babfaa29d51c043468bb7b7aa6a672f8a5dfb059db71a00418ef37d04a8ae95196584e45015c8689412071c6b6bc2f9806311
SSDEEP 98304:CT3W30bkICKxnxg9URaDvYgbdMOsBhcMJ9gf4:730QAxnDsndM5J9Y
TLSH
T15436BF02FA808072F5F3413485BA967B897DBD201724D6C7A3E41D7A4E316E27B3E75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

785420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

695KB

Virtual Size

695KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

112KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=200, id=243, version=40116,

count=29, id=242, version=40116,

count=525, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=13, id=199, version=41118,

count=26, id=259, version=24123,

count=111, id=261, version=24123,

count=21, id=260, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=587, id=1, productName=Unmarked objects,

count=216, id=264, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f

generic

out.upx

generic