25bcb406ef92f49a9ac23cc235e01ada | Triage

Sharing

General

Target

25bcb406ef92f49a9ac23cc235e01ada
Size

89KB
MD5

25bcb406ef92f49a9ac23cc235e01ada
SHA1

32ec5a1566e5878f2007bbef6a7c770ba82689a8
SHA256

1353c53f7c77429eb849752f082fc1d5906e501f939e95605405d5a49c0c3627
SHA512

73899974a8cc3658cc5c1223d2bf5b624236f1c2d865eeb840a4485494dbd2af4c3bed79c548952a7d13f5d4452f3bf999f138c0a43c57c0d71b11b73547cfa4
SSDEEP

1536:Wz50dw0kGKkg/WTWTilyMVsS353bb9eCzWK8sRrTALgubBOdRIpuohCG7:7dwZGKkMdmyj2ICzWbshugubBWCpuohx

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
25bcb406ef92f49a9ac23cc235e01ada
unpack001/out.upx

Files

25bcb406ef92f49a9ac23cc235e01ada
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

load
update_load

Sections

UPX0
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 87KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ