f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86

General

Target
f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86
Size 871KB
Sample261101-1gcxvsft2r
SHA256 f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86
MD5 c391a319fb95e133f05373f67c1c2ae5
SHA1 9a450b2d160bcce9ae3b181c031d02750d5724d4
SHA512 cac4a19ee61e3d91232912e24a3b0b1fb2c5aeae85c56abaac1bd1e284dec74e27de22daacb7e3b945022ef56f569c73181d123a763044cfa5fbf5d7ba7ee76e
SSDEEP 12288:gHjGuiAEwZRYyQmalgrrSUy4WRM371XFrb287BFUBiNgTLQIKnn36qR6:gHjQwZLm+/SUWilVhtFtenwRR
TLSH
T1A81523F844F03A57C9653976A627AC3C541ACB252973FAFB81AF46D16CB0CB48A07097
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86
unpack001/out.upx

File Explorer

f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86

.exe 871KB
out.upx

.exe 2.5MB

f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86

SHA256 f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86
MD5 c391a319fb95e133f05373f67c1c2ae5
SHA1 9a450b2d160bcce9ae3b181c031d02750d5724d4
SHA512 cac4a19ee61e3d91232912e24a3b0b1fb2c5aeae85c56abaac1bd1e284dec74e27de22daacb7e3b945022ef56f569c73181d123a763044cfa5fbf5d7ba7ee76e
SSDEEP 12288:gHjGuiAEwZRYyQmalgrrSUy4WRM371XFrb287BFUBiNgTLQIKnn36qR6:gHjQwZLm+/SUWilVhtFtenwRR
TLSH
T1A81523F844F03A57C9653976A627AC3C541ACB252973FAFB81AF46D16CB0CB48A07097
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9629536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=33, id=241, version=40116,

count=185, id=243, version=40116,

count=33, id=242, version=40116,

count=1, id=29, version=9178,

count=11, id=260, version=27045,

count=22, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=10, id=199, version=41118,

count=67, id=261, version=26706,

count=36, id=260, version=26706,

count=28, id=259, version=26706,

count=3, id=5, version=8447,

count=4, id=25, version=9210,

count=58, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=254, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=260, version=27054,

count=194, id=261, version=27054,

count=1, id=5, version=8168,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,

out.upx

SHA256 2d374b45a2528dcb1356f7e860707cbdad9f57281b78f93aac327eeb40723820
MD5 bd6401cf1a498f0d110e560efd198e29
SHA1 b38b1fa150bde5bb17fea6b9a9d0bf7f550ac8cf
SHA512 2f3748ef94f6b76115cca83fcee436bdda63f37021c81819ec970dc4748d39ec1f05ab63b42137fbc750acb7aca505effed6351b9a33dcd527473d9a5869b591
SSDEEP 49152:kbj3y+SvWekqcbbs3LkM1uTWz+OO8Nyp:kPbIWekCTBzzyp
TLSH
T1A3C57C12B8018076E9D0027191EE9BF6993C6635173938D7E3E15CF46E20AE37E36B5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1783126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=33, id=241, version=40116,

count=185, id=243, version=40116,

count=33, id=242, version=40116,

count=1, id=29, version=9178,

count=11, id=260, version=27045,

count=22, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=10, id=199, version=41118,

count=67, id=261, version=26706,

count=36, id=260, version=26706,

count=28, id=259, version=26706,

count=3, id=5, version=8447,

count=4, id=25, version=9210,

count=58, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=254, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=260, version=27054,

count=194, id=261, version=27054,

count=1, id=5, version=8168,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,

Sharing

General

Malware Config

Signatures

File Explorer

f602912defbb7bf33237e40b2b4c0bb41ea2f676726e5bb19e5f3a246fe15e86

generic

out.upx

generic