f012491a15ed7cecd3f3aa6d740783ea89756d9ba2061812423d18dccfc68b2aN | Triage

Sharing

General

Target

f012491a15ed7cecd3f3aa6d740783ea89756d9ba2061812423d18dccfc68b2aN
Size

112KB
MD5

ebe4a1d608df25c33feaa32d008469f0
SHA1

ff0eca437c1377e0602bf15f71bd9b9c37571d11
SHA256

f012491a15ed7cecd3f3aa6d740783ea89756d9ba2061812423d18dccfc68b2a
SHA512

b7e872135568952b43110fa258d97f17148e8e756c0d8a3c8ca272b5f5add0127a77f6c9e4925964efe043b61eebf0feb5a4178e3b3e86dc7cdcb8d474b6d3b2
SSDEEP

768:CKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYE:foU5bLpXRxMnouy8D

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f012491a15ed7cecd3f3aa6d740783ea89756d9ba2061812423d18dccfc68b2aN

Files

f012491a15ed7cecd3f3aa6d740783ea89756d9ba2061812423d18dccfc68b2aN
.exe windows:4 windows x86 arch:x86

3dcbc7d0ae83594aee771cb6c6621c0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord696
ord697
MethCallEngine
ord518
ord667
ord593
ord594
ord632
ord525
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord716
ord717
ProcCallEngine
ord537
ord644
ord681
ord100
ord616
ord619

Sections

UPX0
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE