b43b3d606f71d008aa4a121cbe503026 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b43b3d606f71d008aa4a121cbe503026
Size

33KB
MD5

b43b3d606f71d008aa4a121cbe503026
SHA1

18a345800a25eb983690418307ba4cc3bdd42b5e
SHA256

baeacbf0b428b9b228e5813db29e3ff1f587cc123ae9a338d0ea590aca8812d9
SHA512

e8adb09ac80f33b78038c3804990a2814f24f5408ae8a590215fff820d023f2e7668a0c06d8660713a1306cc0aebc84b9dd3558cf226256c6af7dcca5b2aa9f5
SSDEEP

384:lB1oKZEl4TU125KIjl+W9+4NPEN42WztUEPFDL9AAFE/ToCPgQcsU+3E1uU30Ldn:lrQexxPO4dFDL6AFEcC4n+Ouc09+

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b43b3d606f71d008aa4a121cbe503026

Files

b43b3d606f71d008aa4a121cbe503026
.dll windows:4 windows x86 arch:x86

9ea78ac63aa8c015268f743deefe0ed3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

DrawStateA
DrawCaption
CreateMDIWindowA
CreateIconFromResourceEx
CreateIcon
CreateDialogIndirectParamA

kernel32

GetStartupInfoA
lstrlenA
lstrcmpiA
lstrcatA
WriteFile
Sleep
SetLastError
EnterCriticalSection
FlushFileBuffers
GetFileSize
GetModuleHandleA
GetPrivateProfileStringA
GetVersion
MapViewOfFile
ReadFile
SetCurrentDirectoryA

Exports

Exports

Activate
DllCanUnloadNow
DllGetClassObject
HookProc
Logoff
Logon
retMain

Sections

.text
Size: 15KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ