UpData[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

UpData.exe
Size

1.4MB
MD5

a05523e2dd0c80c06a4500a97c69d971
SHA1

1df5912bd53e171ba08936ffb8928d1e56322481
SHA256

377a50233aacb3f0317bdd5fb7eb4e9f13244db20b4a808971c9ac71f30175da
SHA512

03d1c8cf482611c42027a61c7511dad382eba6e390e8b89deb5d8608568b0ed72201eaf8b500e412ddaab3a291e4b8e4839de9f39e96cad5ecf26e61c30b638a
SSDEEP

24576:dDcRGAbteOirkEFptVmZ2/WolrVukZd70wFPC+M/WC96dRUg6Z:dnAhefkSpHmZ2/lHB0wdQWVQ

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UpData.exe

Files

UpData.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 1.1MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 26KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 139KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 3.6MB

.itext Size: 7KB - Virtual size: 16KB

.data Size: 26KB - Virtual size: 68KB

.bss Size: - Virtual size: 29KB

.idata Size: 5KB - Virtual size: 16KB

.didata Size: 1024B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.tls Size: - Virtual size: 84B

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: 139KB - Virtual size: 292KB

.rsrc Size: 41KB - Virtual size: 208KB

.aspack Size: 97KB - Virtual size: 100KB

.adata Size: - Virtual size: 4KB

.text
Size: 1.1MB - Virtual size: 3.6MB

.itext
Size: 7KB - Virtual size: 16KB

.data
Size: 26KB - Virtual size: 68KB

.bss
Size: - Virtual size: 29KB

.idata
Size: 5KB - Virtual size: 16KB

.didata
Size: 1024B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.tls
Size: - Virtual size: 84B

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: 139KB - Virtual size: 292KB

.rsrc
Size: 41KB - Virtual size: 208KB

.aspack
Size: 97KB - Virtual size: 100KB

.adata
Size: - Virtual size: 4KB