bff00f6fc638b3b60567504d29804d15b5d7255452968385def3253a96343740 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bff00f6fc638b3b60567504d29804d15b5d7255452968385def3253a96343740
Size

72KB
MD5

10161f36398796f345fe2cdf92779e98
SHA1

c234066e73f1979649606a7029102fed685c17d5
SHA256

bff00f6fc638b3b60567504d29804d15b5d7255452968385def3253a96343740
SHA512

ed805b3a35396dcbcb2021254bf128cb4291d65f35de10d55ab51d17362a8deadaa5060f14399cc5db18981ede8a1548154d84d8521892998d8df8d4a4904c22
SSDEEP

1536:Or0nlDIBPiE8UrgoEskGQiXtbyi0drkwguelKjJVL5xfzmvIV:OylkwEnrciX4ddeXloPfzT

Score

10^/10

upx

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack002/out.upx	Nirsoft

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/PingInfoView.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PingInfoView.exe
unpack002/out.upx

Files

bff00f6fc638b3b60567504d29804d15b5d7255452968385def3253a96343740
.zip
PingInfoView.cfg
PingInfoView.chm
.chm
PingInfoView.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pinginfoview_lng.ini
readme.txt