1df5aa6d20be24bec6420b756473b8d1 | Triage

Sharing

General

Target

1df5aa6d20be24bec6420b756473b8d1
Size

86KB
MD5

1df5aa6d20be24bec6420b756473b8d1
SHA1

bb7807e83d8cbb670b7eb122e5d225a4415f46c7
SHA256

ea6dfc045236f04c890333384b6661f1458beadd9225f8296b5ca0911a2f4c9b
SHA512

4dcf0101b730a276ce7b1fcf373287f1f7a4a68716568596abf031939eb021a894c44d715d82b896bf0534041ede01f07e6ddc5799747164e55e6b80e487692c
SSDEEP

1536:bpg2gCick62WGndL/QoPKrVinbh3aI1jC9drTdOKOKJAGyS3D:Vgb9ckdndLoo+QfmLdOKP2Gyg

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1df5aa6d20be24bec6420b756473b8d1
unpack001/out.upx

Files

1df5aa6d20be24bec6420b756473b8d1
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

load
update_load

Sections

UPX0
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ