5e655a71fa5ec155f338d1a253efe62c | Triage

Sharing

General

Target

5e655a71fa5ec155f338d1a253efe62c
Size

34KB
MD5

5e655a71fa5ec155f338d1a253efe62c
SHA1

2da21e7b8c6579ae1d292375dc82d869b164cfc0
SHA256

a7efa8a74e7a27793bffaed32e643353133555193a0122888826851b18242e68
SHA512

598d8fab0ec72f537988ef9d82c1e772543e27e59cfa4a9771cafd34f9842b9fbb2c2d23016c2a7f4ca82f5b81d01e900337c7566791397f93dca830d674e610
SSDEEP

384:Y7eQ91TnjOPRHL3llRrEAPBJL3dYJ+qpDY+imajqyf:KeQjSPRHJlRrEu33Vy1AF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e655a71fa5ec155f338d1a253efe62c

Files

5e655a71fa5ec155f338d1a253efe62c
.exe windows:4 windows x86 arch:x86

3d8e29a064765089dd82d153c9e2b0d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetModuleHandleA
ReadFile
SetFilePointer
GetModuleFileNameA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
lstrcpyA
lstrcatA
GetTempPathA
LoadResource
WinExec
CopyFileA
GetSystemDirectoryA
lstrlenA
UnmapViewOfFile
GetProcAddress
LoadLibraryA
GetCurrentThreadId
MapViewOfFile
CreateFileMappingA
OpenProcess
TerminateProcess
Sleep
LockResource
SizeofResource
SetFileAttributesA
CreateFileA
WriteFile
ExitProcess
CloseHandle

advapi32

RegEnumValueA
RegOpenKeyExA
RegEnumKeyA

user32

GetMessageA

Sections

UPX0
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE