455c29628b759457728ed41f55e79a15 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

455c29628b759457728ed41f55e79a15
Size

115KB
MD5

455c29628b759457728ed41f55e79a15
SHA1

eee940b7b98b5da69e744d8c4faf4ae4bce03480
SHA256

77fa70f17dd4d17631d66e3ae87b84cf1e8233a492ac7c06d531796c8f1edc2e
SHA512

35cd52d62d2aa8e2498b07fc2d6f612a068a65cf71f1dff149bcbc18fae3342a79cb55db2e1923bcb0e756e91af72a7a86a95701a5118952875f47894f96f9ae
SSDEEP

1536:ZFUzMZBjU/ByDdVBWDOiUfCmDLDCDb/tDLnDaNCIDEoITPCX:fHnvBTPiUfCmfm3/tnWNCIYQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
455c29628b759457728ed41f55e79a15

Files

455c29628b759457728ed41f55e79a15
.exe windows:1 windows x86 arch:x86

45d40da30c944834c663951855fe353d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
LoadResource
LockResource
MoveFileExA
CreateFileA
RtlUnwind
SizeofResource
WinExec
WriteFile
lstrcatA
lstrcpyA

advapi32

RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

crtdll

__GetMainArgs
exit
free
malloc
raise
signal
strchr

user32

RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
CreateWindowExA
DefWindowProcA

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

Sections

UPX0
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE