56a9b94d959a61a14dc41c512cfa4d9b917454c4c5a224928e488b5269ad70bb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56a9b94d959a61a14dc41c512cfa4d9b917454c4c5a224928e488b5269ad70bb
Size

14KB
MD5

0863d9e25f77e9c23b17af9e380970fb
SHA1

837240f155a075ea687f923be24808f1db34a50b
SHA256

56a9b94d959a61a14dc41c512cfa4d9b917454c4c5a224928e488b5269ad70bb
SHA512

6a1a42e0d2d5a6870cc078fc2091d338616d386a5eac9f1916a16853c4de95df7a8cab8bff3cec6847156b1efaa491b32ee2f1228ed9580f00a7a4cafda391cf
SSDEEP

192:cC1MKGT7OQei/B10/MoQPQpB4o1FJMC/5a7CAtQqZbfafshIwJ/PU6SxUJ:c9KGT7HP/BxoQPQL1p/5w3Qwf9pd

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

56a9b94d959a61a14dc41c512cfa4d9b917454c4c5a224928e488b5269ad70bb
.exe windows x86

7b7d307c4222e5a165926df9f012e3a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
lstrlenA
lstrcpyA
Process32Next
lstrcmpA
Process32First
CreateToolhelp32Snapshot
TerminateProcess
GetExitCodeProcess
OpenProcess
Sleep
GetSystemTime
WinExec
lstrcatA
GetCurrentProcess
GetVolumeInformationA
GetSystemDefaultLangID
HeapAlloc
GetProcessHeap
LoadLibraryA
CreateRemoteThread
MapViewOfFile
CreateFileMappingA
GetProcAddress
GetModuleHandleA
GetLastError

advapi32

ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
OpenServiceA
CloseServiceHandle

urlmon

ObtainUserAgentString

user32

wsprintfA

wininet

InternetOpenUrlA
InternetGetConnectedState
InternetReadFile
InternetOpenA
InternetCloseHandle

Sections

UPX0
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE