UpData[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

UpData.exe
Size

1.6MB
MD5

ebe2550c9bb63717287947bff8290abc
SHA1

19fe7e549427f2296d73586cac3210bda8ee4c9a
SHA256

0e803a99308bf32675d3a8b3c492cc3e7c2324d0df0baeb91441a3f911ba96af
SHA512

a5e6f8c394e6b8c0db9e8d14b27f76ead86c6a1b4881fb41fa6cc176bc1077497c159e5bca2ff46ac91dfa8dcc5dcbd3eb7a4f4f21b23c0b1d1b575246ffc6bd
SSDEEP

49152:M8kyWnq91p9YlNPkMFQX2c29icQue9FU:nwSXg/0D4QxFU

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
aspackv2

Processes:

resource yara_rule

sample aspack_v212_v242
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

UpData.exe

resource	yara_rule
sample	aspack_v212_v242

resource
UpData.exe

Files

UpData.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 1.2MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 26KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 147KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 140KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 3.9MB

.itext Size: 8KB - Virtual size: 20KB

.data Size: 26KB - Virtual size: 72KB

.bss Size: - Virtual size: 28KB

.idata Size: 5KB - Virtual size: 16KB

.didata Size: 1024B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.tls Size: - Virtual size: 84B

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: 147KB - Virtual size: 312KB

.rsrc Size: 130KB - Virtual size: 400KB

.aspack Size: 140KB - Virtual size: 144KB

.adata Size: - Virtual size: 4KB

.text
Size: 1.2MB - Virtual size: 3.9MB

.itext
Size: 8KB - Virtual size: 20KB

.data
Size: 26KB - Virtual size: 72KB

.bss
Size: - Virtual size: 28KB

.idata
Size: 5KB - Virtual size: 16KB

.didata
Size: 1024B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.tls
Size: - Virtual size: 84B

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: 147KB - Virtual size: 312KB

.rsrc
Size: 130KB - Virtual size: 400KB

.aspack
Size: 140KB - Virtual size: 144KB

.adata
Size: - Virtual size: 4KB