1ff9596827638b526d308b3a0a2e88c5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ff9596827638b526d308b3a0a2e88c5
Size

89KB
MD5

1ff9596827638b526d308b3a0a2e88c5
SHA1

3970371d06b2a8cd81374ca92163416f38e672ab
SHA256

0854b9e0a83129f05fb31dc9590da7e6e2153293e0ff3a590ff25022fbf18406
SHA512

4c5044dc2450e8deb1236a5d427b15eb0847998d998434193b371e0913dda85be4b8d1654c055bf2b2024b221c55bd302e45c1bd1a35ea01752c9ace6475c81e
SSDEEP

1536:65j6gP8ghdRtgZjqmUVsiPT980SmDCRPGaIkkEqizY+fFcNG599K7:uu4hWMp9T98mAcqYtG59U

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1ff9596827638b526d308b3a0a2e88c5
unpack001/out.upx

Files

1ff9596827638b526d308b3a0a2e88c5
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

load
update_load

Sections

UPX0
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 87KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ