f45de4afd3037393120e553b07b56146a059897bd936f91fa87c7b07e245cb01 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f45de4afd3037393120e553b07b56146a059897bd936f91fa87c7b07e245cb01
Size

26KB
MD5

df221e09af9dff39edd261058b0f1a22
SHA1

235b8184b7cecf49570c25fb2e000b9c10ca1c18
SHA256

f45de4afd3037393120e553b07b56146a059897bd936f91fa87c7b07e245cb01
SHA512

d761e0c3e167ac91d8b881a79b64d33cd9e92ba469d015b8743f89788d4f10d4ff3a8471e2947c3ea47c2552e5db1bbecf37be9f24ec4b5e0c1a2fc29c1143a1
SSDEEP

384:7HTLUFLg5seuuhmlz5uwysBOokWI5fts:737Ou1whBOKI5Vs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

f45de4afd3037393120e553b07b56146a059897bd936f91fa87c7b07e245cb01
.exe windows x86

2eb4a80f96f4f0a578f2ae20706ce9ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
GetFileSize
Sleep
GetModuleFileNameA
WinExec
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetStringTypeW

wsock32

recv
WSAStartup
socket
gethostbyname
htons
connect
closesocket
send
shutdown
WSACleanup

Sections

UPX0
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE