720e0dcc321353eac37c057ea4847c88 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

720e0dcc321353eac37c057ea4847c88
Size

343KB
MD5

720e0dcc321353eac37c057ea4847c88
SHA1

a645b9b1062deb87eebc380072b5289f3aaaa280
SHA256

9d10b293ea526f7625f826d06074edad08c23fe300a91a9939e7c4b515f8031d
SHA512

ae7bbc7509c036ed304867e8aad028d4f2dd113cee0563418de46c31bba26c96311ed238ec12707db105ed799f8d380dc6fcb255973897d0d80f6edfd4566779
SSDEEP

6144:F3hiGiXlMw8GvY59JRjN8JCrQXzhT1egD6pqS/gNubs1raQ3KbSzS00S:thERtvYHJRjeZNTYgVNubs1KbAS00

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
720e0dcc321353eac37c057ea4847c88

Files

720e0dcc321353eac37c057ea4847c88
.exe windows:4 windows x86 arch:x86

9612c82b4c865e0bf6797463aa91292a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
ExitProcess

advapi32

RegCloseKey

avicap32

capCreateCaptureWindowA

comctl32

ImageList_Add

gdi32

BitBlt

ole32

IsEqualGUID

oleaut32

SysStringLen

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

user32

GetDC

winmm

timeGetTime

winspool.drv

ClosePrinter

ws2_32

WSACloseEvent

wsock32

bind

Sections

UPX0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 338KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

FCryptor
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ