f8eb63613aafa9133de101c33c6a643261a142e932c75161d34a44a076214139 | Triage

Sharing

General

Target

f8eb63613aafa9133de101c33c6a643261a142e932c75161d34a44a076214139
Size

112KB
MD5

5a4708332e8a85f2d3d6317d6fe44530
SHA1

02a786ce38e383ff9e6d7cc38244eaa585b349d2
SHA256

f8eb63613aafa9133de101c33c6a643261a142e932c75161d34a44a076214139
SHA512

49df99d1de2bf4b0188827fb7547495236d5c9bd964635e10a0ab22f17198c85db54ec84bd582153ef8566dffcb9bd3d9f1ecefc50f5e9c6fcaf884f8a3b8f3f
SSDEEP

3072:+oL+w3q0A0s5/3ZmyKMpPN4qvTmlo8b+5:Ti0s5pmylPdiloD

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

f8eb63613aafa9133de101c33c6a643261a142e932c75161d34a44a076214139
.exe windows x86

4daa50fb1bfde898cf3800cd964c91dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_initterm
_controlfp
_except_handler3
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
__set_app_type
_c_exit

kernel32

GetModuleHandleA
lstrcmpiA
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
lstrlenA
GetStartupInfoA

ole32

CoRegisterSurrogateEx
CoInitializeEx
CLSIDFromString
CoUninitialize

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE