afad86821e279ebd07aa19ee13e8f7beaadde6953dc2dc7ae3a9b849f3370385 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

afad86821e279ebd07aa19ee13e8f7beaadde6953dc2dc7ae3a9b849f3370385
Size

576KB
MD5

93215e92e35806424969e1f09545da1c
SHA1

ddb06c329b709ed65c09d6b82edc382c4291e637
SHA256

afad86821e279ebd07aa19ee13e8f7beaadde6953dc2dc7ae3a9b849f3370385
SHA512

83dab634940d0299de743bca0404523b1d9af349f3bcd5079636744db5c4c048fb94a16a0f63d1908fb07246d7646f4e25b70ef5cfad5392e056c17c2e5834ad
SSDEEP

12288:8TOAkRj7IqoRHaxYmzzxrFdLh/20lRSgiDnhf59NMRDg:86AkRjyaxYmdxdLxtei6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

afad86821e279ebd07aa19ee13e8f7beaadde6953dc2dc7ae3a9b849f3370385
.exe windows x86

aac60df60ca85a65dc1aa5d99d8cccdd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
lstrlenA
GetTempPathA
RemoveDirectoryA
SetCurrentDirectoryA
EnumResourceNamesA
GetUserDefaultLangID
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessA
GetPriorityClass
GetCurrentProcess
GetCommandLineA
lstrcmpiA
DeleteFileA
SetFileAttributesA
lstrcatA
GetStartupInfoA
ExitProcess
GetModuleHandleA

user32

CharNextA
wsprintfA

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 906B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 456KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE