63e37e5da561402c402df3e1bd4c43310e724187daca8af1ff19379cd517ad18 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63e37e5da561402c402df3e1bd4c43310e724187daca8af1ff19379cd517ad18
Size

132KB
MD5

7497b784c34123ed6d67aaf3293f55d0
SHA1

1ed758b580cee19cc2aae4c149acbf9366f2ae9e
SHA256

63e37e5da561402c402df3e1bd4c43310e724187daca8af1ff19379cd517ad18
SHA512

059e6ad8ab20b3762feaffd158a513b1328f69c0f0a57a64b752934bb874eb8dd762cefa01182bad307825e3f7b4321642c2a3faccf7b060fa550e5b7c0789aa
SSDEEP

3072:zvv44DYi5E+hHZVgOxhUEy0uOkypaYKF3/O8n:zX9l5E+hHPDxiWuOkyXkO6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

63e37e5da561402c402df3e1bd4c43310e724187daca8af1ff19379cd517ad18
.exe windows x86

46084168b412e051097ae39c055c9320

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
ExitProcess
FormatMessageA
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

Sections

.text
Size: 24KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE