5328f017e9c25f2d55bca39af59a8260 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5328f017e9c25f2d55bca39af59a8260
Size

14KB
MD5

5328f017e9c25f2d55bca39af59a8260
SHA1

0866e26df6e009a76c6d8aabe9163ba59b4e30d4
SHA256

48df0fc10f45e9b10ba2d4324c173b03ed85bdcabe4d948d1ae30597691f7151
SHA512

44cb565f727191111d3e08dac5450390046c0752f4a74c574c26fd113adbed3d9c7554ef6a1b8a9487b1ffc7574471c2ddb4787009528a814d6f01365191e3da
SSDEEP

192:txMizQZCsccTF2h5q6RkHKdK4aSZr6EKXVQLwoB:1EZl2inKFLwm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5328f017e9c25f2d55bca39af59a8260

Files

5328f017e9c25f2d55bca39af59a8260
.exe windows:4 windows x86 arch:x86

cf6e840dcb6b3fea2368f7dcb5a6fe4c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetModuleFileNameW
lstrcpyA
CompareStringA
CreateToolhelp32Snapshot
CreateEventA
CloseHandle
WideCharToMultiByte
ExitProcess
ExitThread
CreateThread
Process32First
LoadLibraryA
RtlUnwind

advapi32

RegFlushKey
RegCloseKey

user32

GetDesktopWindow
DispatchMessageA
SetThreadDesktop
ShowWindow
PeekMessageA
CreateWindowExA
TranslateMessage
CreateDesktopA
MsgWaitForMultipleObjects
DestroyWindow

Sections

UPX0
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE