788e7657ab1fdcb04cfd63dd00e30280_exe32[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

788e7657ab1fdcb04cfd63dd00e30280_exe32.exe
Size

248KB
MD5

788e7657ab1fdcb04cfd63dd00e30280
SHA1

1cc09224f50ee35c1bc6a9621f0c96015c13d19c
SHA256

b3df156a81393e13e5d46ddab5e54c1a0ac610a3016cb3db9ab334ed566812c3
SHA512

4760443195d26f4981913c6b296249e89c9aeaba42650d4b4f72c2cf6bccfec82266c01dacb6ec001f18809107a0bfa0a9271bfd5c5754d4380824fed2c439dd
SSDEEP

3072:fwbVMfMIbIaw3J9b5GCQ0Gg+BC3K5eqU+BC3K5eqYroGfOw2/oucr+:fwWfMmMHGCPGIK70K72J

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
788e7657ab1fdcb04cfd63dd00e30280_exe32.exe

Files

788e7657ab1fdcb04cfd63dd00e30280_exe32.exe
.exe windows:1 windows x86

6cf6b7ca087d841c9daab77af713fe37

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
GetModuleHandleW

crtdll

__GetMainArgs
exit
raise
signal

iphlpapi

GetAdaptersInfo

ntdll

RtlFreeHeap

ulib

??0PATH@@QAE@XZ
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE