03443754bc1c793687dea682353a12e94c6e57108d0c170081c07ed8b11c157f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03443754bc1c793687dea682353a12e94c6e57108d0c170081c07ed8b11c157f
Size

60KB
MD5

bd209694058082b035d0b99459b5c6d1
SHA1

6bd1dcbf7be8b6b1b2c43b3b73ecfd3975b7fcec
SHA256

03443754bc1c793687dea682353a12e94c6e57108d0c170081c07ed8b11c157f
SHA512

3ff40da4fbd5308ff6c4eb7fee90d365beed87f990d08c6acc7858cfe720f6a65b59304c14c61ac0f5e45586803096c26f62457e13ddbafcc0fe9af54069dbd6
SSDEEP

1536:L29rw5t3d9Pmrzh0N/0EjqfdWVvQSdTyj90Kc85LUUCQ:C6TvN8RlUvQSdU+qwQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

03443754bc1c793687dea682353a12e94c6e57108d0c170081c07ed8b11c157f
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

QQ841374296
aaaaaaaaaaaaaaaaaaaaa
ggggggggg
hk3600
wwwwwwwww
xxxxxxxxx
zxsahduo

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ