1a99a69c2f07d522ba84342a3d7d8606 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a99a69c2f07d522ba84342a3d7d8606
Size

341KB
MD5

1a99a69c2f07d522ba84342a3d7d8606
SHA1

ad8c180f54bea1168daec2156ddf4780847612e0
SHA256

71f81a79c6afc8dede2b52a9d33a0ca49aa7d3751b6f64566812710c391985f8
SHA512

5b14a5ed76f27d6967c98706275702db75822d396d79c0013db2c26687a09747e01ae432f9746bee6565c62d8a8ccecd58d2080a7758fae6287a2e739297acdb
SSDEEP

6144:TsrRi0iO1nUtiQfBmwYzgzrrFGJIUKS+tUHmWFwLSCmDxuvNJSCvz/6CC1:ei0iyUtiQfcEKIptqHmWCSLx4JS4zzE

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a99a69c2f07d522ba84342a3d7d8606

Files

1a99a69c2f07d522ba84342a3d7d8606
.exe windows:4 windows x86 arch:x86

9612c82b4c865e0bf6797463aa91292a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
ExitProcess

advapi32

RegCloseKey

avicap32

capCreateCaptureWindowA

comctl32

ImageList_Add

gdi32

BitBlt

ole32

IsEqualGUID

oleaut32

SysStringLen

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

user32

GetDC

winmm

timeGetTime

winspool.drv

ClosePrinter

ws2_32

WSACloseEvent

wsock32

bind

Sections

UPX0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 336KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

19G8POW4
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ