2bb1df4c517d0a47c682dce6b5dadb49 | Triage

Sharing

General

Target

2bb1df4c517d0a47c682dce6b5dadb49
Size

96KB
MD5

2bb1df4c517d0a47c682dce6b5dadb49
SHA1

bc4b8c1f9a2e848a00a2b7e3f881fbdb4c79005a
SHA256

63ffaefbcef7007b2e739222b976eb1563b6f31e287d5595e83731411af6b6c7
SHA512

bdf1dff9868ef5128845ffd0eba95237e65fb3fe4b00f0b25f74fe3f6ca8442d562dde67efd28b94aa9bfef89ddccc3813e830bc017ac7f70bb415b00ad3202b
SSDEEP

384:aFwbRbw370AYoIDMb8JDFwbRbw370bsEm:a2bRb65KjJD2bRb6U

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bb1df4c517d0a47c682dce6b5dadb49

Files

2bb1df4c517d0a47c682dce6b5dadb49
.exe windows:5 windows x86 arch:x86

98ecfc6f04d7bc5614005b07fa36ab8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
ReadFile
ExitProcess
GetTickCount
GetModuleFileNameW
VirtualFree
VirtualAlloc
lstrlenA
CloseHandle
CreateFileW

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext

ntdll

_wtoi

ole32

CreateStreamOnHGlobal

user32

wsprintfA
wsprintfW

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpQueryHeaders

Sections

UPX0
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE