a91d0445f251b081ac6c0d05fb0fb7ca4661f5f124bab9f2748e17ed420d6e20 | Triage

Sharing

General

Target

a91d0445f251b081ac6c0d05fb0fb7ca4661f5f124bab9f2748e17ed420d6e20
Size

46KB
MD5

66db213ae2bc604e651d99c2fd98876f
SHA1

ebeb6b6c609f0344f7117bac773acee7c61004ea
SHA256

a91d0445f251b081ac6c0d05fb0fb7ca4661f5f124bab9f2748e17ed420d6e20
SHA512

113ffd4e044c86b05f0cdc7e3abdebf785823e6133b398a60bbc77d87422ced07bec057f0cbb786d3677c4d9c8fefa5d413fe6dcae7f3ac2a85a0dc52cda19b0
SSDEEP

384:HnBW9CwHgul4MUzuNCTlKNaMn1wv8hAuEU4s036CLbMLAaO:HBEHgHMY2mKRh3LhO

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

a91d0445f251b081ac6c0d05fb0fb7ca4661f5f124bab9f2748e17ed420d6e20
.exe windows x86

dc3746a89d39beff1c09bcf9f024da79

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

WriteFile
SetFileTime
ReadFile
MoveFileExA
GetTempPathA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetFileTime
GetFileSize
CreateFileA
CloseHandle
GetCurrentThreadId
ExitProcess
RtlUnwind
RaiseException
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
FreeLibrary
GetProcessHeap

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Sections

UPX0
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE