3668742965380a9406707147ed4f9d5939dbbae9cfc0523afad1a09fd4488e3c | Triage

Sharing

General

Target

3668742965380a9406707147ed4f9d5939dbbae9cfc0523afad1a09fd4488e3c
Size

156KB
MD5

25a4e26d7f01ea15d0e8c38237d874b0
SHA1

bdd3a0c467d9bc518c013d3a4cb7d3a4ff17960e
SHA256

3668742965380a9406707147ed4f9d5939dbbae9cfc0523afad1a09fd4488e3c
SHA512

5c24d71eabe14f2c23e4db27faad75243c57b768d3b6cb6c3439b40daed10c54018c4d8d62675d17d0c7b5840b0b6e43814692d1eea7158024c3d3c5e8e8de19
SSDEEP

3072:9wlR09VVrWb+w8GHvPMwG6J+Ux9DW2J0qL95DvzRK6:Kl23FBdGHv/JRxM2Jptvt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

3668742965380a9406707147ed4f9d5939dbbae9cfc0523afad1a09fd4488e3c
.exe windows x86

2d4c74f56cb64178ce976c5dc4c67ffe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rsxnt

RSXNT_Call
RSXNT_Init

kernel32

CloseHandle
CreateEventA
GetCurrentThreadId
OpenEventA
ResetEvent
SetEvent
Sleep
WaitForSingleObject

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1018B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE