Suspicious ^91% Download

xnxnxnxnxnxnxnxnpowerpc440fpxnxn.elf

UPX packed, stripped, high entropy

ELF zeroes trailing UPX metadata to block standard unpackingSectionless high-entropy trailing UPX ELF

SHA-2565fdaa36b835482b95d7cfd5cb414376d48e92cf1f5657d6b2e59c1872073785d

URLhttps://tria.ge/api/v0/samples/261005-wwd19azbng/sample

Evidence

Sectionless high-entropy trailing UPX ELF 0x0–0x250

0x07f454c46010201030000000000000000.ELF............
0x1000020014000000011049024800000034.........I.H...4
0x2000000000000000000034002000030028.........4. ...(
0x3000000000000000010000000010000000................
0x401000000000001000004749d800000006.........GI.....
0x5000010000000000010000000010480000.............H..
⋯32 more rows

References own executable procfs path 0x10531–0x105f1

⋯3 more rows
0x105612454006026ffffb6bb5f81202f192000$T.`&...._. /. .
0x105713d2f70726f632f73656c662f657865b7=/proc/self/exe.
0x10581ffdf6d147e433881fffc419200083821..m.~C8...A...8!
⋯7 more rows

UPX packer banner string 0x1155a–0x1178a

⋯7 more rows
0x115ca1bfc930000f01ccf0748000000ff0a00.........H......
0x115da24496e666f3a20546869732066696c65$Info: This file
0x115ea206973207061636b6564207769746820 is packed with 
0x115fa74686520555058206578656375746162the UPX executab
0x1160a6c65207061636b657220687474703a2fle packer http:/
0x1161a2f7570782e73662e6e657420240a0024/upx.sf.net $..$
0x1162a49643a2055505820352e303220436f70Id: UPX 5.02 Cop
0x1163a7972696768742028432920313939362dyright (C) 1996-
⋯16 more rows
0x1174a673e1b537438fbfdd8e8bb5e67fa0000g>.St8.....^g...
0x1175a00000055505821000000000000005550...UPX!.......UP
0x1176a58210e840e0a0003720c000117688a16X!......r....h..
0x1177a84a4348e82210003720cd00200490000..4..!..r....I..
0x1178a00a0                            ..              