a0e6089e8ff6a61f8463323a448794ce | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a0e6089e8ff6a61f8463323a448794ce
Size

98KB
MD5

a0e6089e8ff6a61f8463323a448794ce
SHA1

df3cc8780ac3893f8aaf6cbeea097e8db2693a45
SHA256

904fde68e80f67eb730b4ab53bfd2756a159febe7667243fc05da2f0a90c09f1
SHA512

91665d2bbe5cd1f3cd7551f2ec50653312626c9ca9ac01c15d68815dbb34c98ed9d8518cde2e6fab333288d8fceb2a9c8120e7adaf6dc797f675baf277c730c9
SSDEEP

384:Fpc4HE+EfX064m+ABb1L40U8/BsglCcUq52rwa:Fvk+EfEviL40U8ZsgUcUq52rl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0e6089e8ff6a61f8463323a448794ce

Files

a0e6089e8ff6a61f8463323a448794ce
.exe windows:1 windows x86 arch:x86

d2011d83418582fad09eb0de89ed6c90

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersionExA
GlobalMemoryStatus
CopyFileA
LoadLibraryA
CreateFileA
RtlUnwind
Sleep
TerminateThread
CreateProcessA
WriteFile
CreateThread

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA

crtdll

__GetMainArgs
_sleep
atoi
exit
memset
raise
rand
signal
sprintf
srand
strcat
strchr
strcmp
strncmp
strncpy
strstr
strtok

shell32

ShellExecuteA

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

wsock32

WSACleanup
WSAStartup
closesocket
connect
gethostbyaddr
gethostbyname
htons
inet_addr
recv
send
socket

Sections

UPX0
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE