dfcf31d351ec57942184abbc445cf2e7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfcf31d351ec57942184abbc445cf2e7
Size

22KB
MD5

dfcf31d351ec57942184abbc445cf2e7
SHA1

22377cd67331438cae432ad5c83019dd41a83edb
SHA256

2b6e08921023dc2652f9b4d936580021e3d1c5346a9d496ab58e8436a63524c1
SHA512

1e637c34cbc0ede22218a8acae3976c9d64b9a99ab35b9b132891a3b18183b8cdc2d2656d1e1860b8c656c2b899a6e7cb6ef200d8d1db4e843f7eaa5e15c3065
SSDEEP

96:6VVfDqRijlBLqdIwCltywvWctuQRZBD3:oFvAIw0tywvWcZ/h

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfcf31d351ec57942184abbc445cf2e7

Files

dfcf31d351ec57942184abbc445cf2e7
.exe windows:1 windows x86 arch:x86

a4d01b7bf98c821a8b69fee98a3c9057

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CloseHandle
CopyFileA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetLocalTime
GetModuleHandleA
GlobalAlloc
GlobalFree
ReadFile
SetCurrentDirectoryA
SetFilePointer
Sleep
WinExec
WriteFile
lstrlen

advapi32

GetUserNameA

user32

CallNextHookEx
DispatchMessageA
GetForegroundWindow
GetKeyboardState
GetMessageA
GetWindowTextA
GetWindowTextLengthA
SetWindowsHookExA
SwapMouseButton
ToAscii
TranslateMessage
UnhookWindowsHookEx
wsprintfA

winmm

mciSendStringA

wsock32

WSACleanup
WSAStartup
accept
bind
closesocket
htons
listen
recv
send
socket

Exports

Exports

KeyboardProct

Sections

UPX0
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE