Trojan-Ransom[.]Win32[.]Blocker[.]ixrc-60097196e5e6098ea2b5ea3fc35f47f5c11f2dae83837bbf6cfdfde2b1374261 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Trojan-Ransom.Win32.Blocker.ixrc-60097196e5e6098ea2b5ea3fc35f47f5c11f2dae83837bbf6cfdfde2b1374261
Size

16KB
MD5

87204dcf6beed7ce9a89c04a1b32a6a4
SHA1

29cd6e3c242bcc8fddda7320820fce21ec80cf09
SHA256

60097196e5e6098ea2b5ea3fc35f47f5c11f2dae83837bbf6cfdfde2b1374261
SHA512

23a88448144964af5febccba878f7282a1fc3b389f8bd357832976d53f46f8456218c50023787457cc0a9f35dde2e65cd13749797409e9ff7bc209cbcb6663d9
SSDEEP

384:V+P7oL7ql2y8TgF0LlR2bOo8eoKRIumcZLPX/ZJuf:07oC8yd++ikoKRe4LPX/ZC

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

Trojan-Ransom.Win32.Blocker.ixrc-60097196e5e6098ea2b5ea3fc35f47f5c11f2dae83837bbf6cfdfde2b1374261
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE