0ffa1330a318c9ec71fb1c81ad9483b7 | Triage

Sharing

General

Target

0ffa1330a318c9ec71fb1c81ad9483b7
Size

104KB
MD5

0ffa1330a318c9ec71fb1c81ad9483b7
SHA1

755099b62fa4714dfd0b6ad3904ceeb8a551adca
SHA256

7df9431f791c2f88420208fe90934bb8bf8273dcc622de141792d46b66fdf2c7
SHA512

9273512bab8e2175d74af04cbd5a324eb031069c2555ea2548931de7a1c6b240ee72b9b158a04a4b720a614a25e7f167ae4bd10fb16c3fff019d37ce8de0c5fe
SSDEEP

1536:Y4Ejlu0q/foo86hxXWkE4enFTMN1I0kJJ01yBEjEX3Z2x3gi7e6OvBJWF92QsWF:Y4EjQ/fxvvlAsWJAGEj03uRYHs2c

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ffa1330a318c9ec71fb1c81ad9483b7

Files

0ffa1330a318c9ec71fb1c81ad9483b7
.exe windows:4 windows x86 arch:x86

6edf71f7cb1c12fa8bd390e5f71d5a21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaPutOwner3

kernel32

GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX1
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ