0efc0837ec20616e10df4877463b6b1519bf556b551f3c421660dec6fc51ec9a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0efc0837ec20616e10df4877463b6b1519bf556b551f3c421660dec6fc51ec9a
Size

71KB
MD5

5c7c7657a23d8c5792e05da7ee93e460
SHA1

2fc99eba43c4020c13b09374dedcbac904c95640
SHA256

0efc0837ec20616e10df4877463b6b1519bf556b551f3c421660dec6fc51ec9a
SHA512

c7ce84f5136739d08ace385a859019d845f6bc3582a8006d6f9e37a2e6e067a92955a9d97251612e456ea94c74f54a8bd52becb43da83a4bb8c0fc605eeda68c
SSDEEP

1536:4N33mqdgcxUtrLkLScojp20ilAcSB/FehByQQFszn:gnmqd6WcpfilJSBdiByQQs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

0efc0837ec20616e10df4877463b6b1519bf556b551f3c421660dec6fc51ec9a
.exe windows x86

92c288bfa34cc55c9aac3e7e3ee04d99

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA

advapi32

RegCloseKey

ntdll

NtUnmapViewOfSection

oleaut32

SysFreeString

shell32

SHGetMalloc

shlwapi

SHDeleteKeyW

urlmon

URLDownloadToCacheFileW

user32

CharNextW

wininet

FtpPutFileW

Sections

UPX0
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE