Suspicious 91% Download

xnxnxnxnxnxnxnxnpowerpcxnxn.elf

UPX packed, stripped, high entropy

Sectionless high-entropy trailing UPX ELFStatic sectionless ELF with a UPX banner
SHA-256dba846bc50334572d41e61227ed36c064b471c51f1a6f4448616555a2a26361f
URLhttps://tria.ge/api/v0/samples/261003-vfyv2ssgrc/sample
MaleculeO(As₂)H₂(CmF₂)Md₃(Bi₄BkHe)Th

Evidence

Sectionless high-entropy trailing UPX ELF 0x0–0x140
0x07f454c46010201030000000000000000.ELF............
0x1000020014000000011005f23000000034...........0...4
0x2000000000000000000034002000030028.........4. ...(
0x3000000000000000010000000010000000................
0x4010000000000010000004856000000006...........`....
0x5000010000000000010000000010050000................
⋯15 more rows
References own executable procfs path 0xf519–0xf5d9
⋯3 more rows
0xf5492454006026ffffb6bb5f81202f192000$T.`&...._. /. .
0xf5593d2f70726f632f73656c662f657865b7=/proc/self/exe.
0xf569ffdf6d147e433881fffc419200083821..m.~C8...A...8!
⋯7 more rows
UPX packer banner string 0x10542–0x10702
⋯7 more rows
0x105b21bfc930000f01ccf0748000000ff0a00.........H......
0x105c224496e666f3a20546869732066696c65$Info: This file
0x105d2206973207061636b6564207769746820 is packed with
0x105e274686520555058206578656375746162the UPX executab
0x105f26c65207061636b657220687474703a2fle packer http:/
0x106022f7570782e73662e6e657420240a0024/upx.sf.net $..$
0x1061249643a2055505820352e303220436f70Id: UPX 5.02 Cop
0x106227972696768742028432920313939362dyright (C) 1996-
⋯14 more rows
Canonical trailing UPX PackHeader magic 0x10728–0x107c8
⋯7 more rows
0x10798137edfdb000000005550582100000000.~......UPX!....
0x107a8555058210e840e0a000302c8000107a8UPX!............
0x107b881db25e7d3e5e958000302c8d0020054..%....X.......T
0x107c8000000a0 ....

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.