Suspicious 91% Download

jaffacakes118_562e51f39b48d9b354c459043ddbc5e73dd14e2b68b890094f124d0746e0dab2.bin

UPX packed, stripped, high entropy

Sectionless high-entropy trailing UPX ELFStatic sectionless ELF with a UPX banner
SHA-256562e51f39b48d9b354c459043ddbc5e73dd14e2b68b890094f124d0746e0dab2
URLhttps://tria.ge/api/v0/samples/260927-l83j9svy6m/sample
MaleculeO₂(As₃Al)H(Cm)Md₅(ArBi₄BkHe)Th

Evidence

ARM architecture from ELF header bytes 0x0–0x250
0x07f454c46010101030000000000000000.ELF............
0x100200280001000000a001010034000000..(.........4...
0x2000000000020000043400200003002800........4. ...(.
0x3000000000010000000000000000800000................
0x40008000008d9300008d93000005000000................
0x500080000001000000144b0000144b0300.........K...K..
⋯32 more rows
UPX packer banner string 0x8c34–0x8df4
⋯5 more rows
0x8c84000000ef7f00a0e30170a0e3000000ef.........p......
0x8c9450524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x8ca452495445206661696c65642e0a000a00RITE failed.....
0x8cb424496e666f3a20546869732066696c65$Info: This file
0x8cc4206973207061636b6564207769746820 is packed with
0x8cd474686520555058206578656375746162the UPX executab
0x8ce46c65207061636b657220687474703a2fle packer http:/
0x8cf42f7570782e73662e6e657420240a0024/upx.sf.net $..$
0x8d0449643a2055505820332e393420436f70Id: UPX 3.94 Cop
0x8d147972696768742028432920313939362dyright (C) 1996-
⋯14 more rows
Canonical trailing UPX PackHeader magic 0x9418–0x94b8
⋯7 more rows
0x94887b800000000055505821000000000000{.....UPX!......
0x9498555058210d170e0a280a3894b9f27eb6UPX!....(.8...~.
0x94a850020000d700000084a40100500000d9P...........P...
0x94b8a0000000 ....

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.