b7cc18bf0517c8f2690b0190ed9e5630N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b7cc18bf0517c8f2690b0190ed9e5630N.exe
Size

176KB
MD5

b7cc18bf0517c8f2690b0190ed9e5630
SHA1

b84cc47437bee7cc953793898e551be99b777bee
SHA256

ae2ab99fffb2c7f62d99f1ba44f4156579df9de49505b0c08b05579047094c76
SHA512

da51ae9b6d1473708c2487af1fa8138035124a703d52da95ae696ef59a6327dfe91e8b82a01a32c27b084bf6b9b76b43df9606723398110b56751978ba83e198
SSDEEP

768:Lqnum1MpQNwC3BESe4Vqth+0V5vKPyLylze70wi3BEmb:Lvm1keT7BVwxfvLFwjRb

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7cc18bf0517c8f2690b0190ed9e5630N.exe

Files

b7cc18bf0517c8f2690b0190ed9e5630N.exe
.exe windows:4 windows x86 arch:x86

bfbf457d52153d2191e67bb6c9212334

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord593
ord594
ord595
ord598
ord525
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
ord670
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord608
ord530
ord716
ProcCallEngine
ord537
ord645
ord570
ord685
ord100
ord616
ord542
ord545
ord546
ord547
ord580

Sections

UPX0
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE