4704cc5844d5fa8c51f318b7ecba5eb6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4704cc5844d5fa8c51f318b7ecba5eb6
Size

132KB
MD5

4704cc5844d5fa8c51f318b7ecba5eb6
SHA1

5b5ad234c133bea0b6609e0533fd218f2c1f7e7b
SHA256

52f79d17d761cc7388b18f3604b096dffa02136f775988247fe10d6bbbb80f4f
SHA512

39e7f975eb155e11c3eef987b48c2b221ecadbcf45941b4053ad23a86f9bb029d04590a8d66f19d9b230090e05383f726ae30c90dcf3946eefa984e8e5ef5db9
SSDEEP

3072:jiIL1d0p0+QZE1yxYoAHZMLhi9qo3pfOwNzU3nWl4:fL1dM0+Qm1yxqH0i9FOFWl4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4704cc5844d5fa8c51f318b7ecba5eb6

Files

4704cc5844d5fa8c51f318b7ecba5eb6
.exe windows:5 windows x86 arch:x86

46084168b412e051097ae39c055c9320

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
ExitProcess
FormatMessageA
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

Sections

.text
Size: 24KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE