2b7a1b72ff41792c8558da5221597c21 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b7a1b72ff41792c8558da5221597c21
Size

54KB
MD5

2b7a1b72ff41792c8558da5221597c21
SHA1

a308b43e0488381dc3d5d6032c95fa0a3b74f8fc
SHA256

7d6c36f539f389641183de70a6ad159fba5252e19ce38ae9fafa104a75139d48
SHA512

413480c995341abb6a6c16632b29318d9054f14c46fc6005407788bf6abf9c1b9f97e442af960762eddddd4ec005713d8e12987f8bdb574372c8ec9095fe78db
SSDEEP

384:yEkveauq+htqc5BWDR2AsDWQ1L/4aZC6f0O8P62qq43WV9p6vC9TXczONLz/SK9a:wWYc5BEoAsDH5C6/b3If66tWQjF5mII

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b7a1b72ff41792c8558da5221597c21

Files

2b7a1b72ff41792c8558da5221597c21
.exe windows:4 windows x86 arch:x86

67b71fb08325a667f518ed1dfd4026f0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
lstrcpyA
lstrcatA
WriteFile
TerminateProcess
Sleep
CloseHandle
CopyFileA
CreateFileA
CreateToolhelp32Snapshot
ExitProcess
FindResourceA
GetFileTime
GetModuleFileNameA
GetModuleHandleA
LoadResource
LockResource
OpenProcess
Process32First
Process32Next
SetFileTime
SizeofResource

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

shell32

StrStrIA
ShellExecuteA
SHGetSpecialFolderPathA

Sections

UPX0
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE