97a2922411f42b6144d30d614aef1a9fc129b8cffbc7c4e2b5eeb7d4afe5cde8 | Triage

Sharing

General

Target

97a2922411f42b6144d30d614aef1a9fc129b8cffbc7c4e2b5eeb7d4afe5cde8
Size

392KB
MD5

1fb6f9dbd8b2406b2f3f6751402387a5
SHA1

01aac21e1f3983fab9a11af3bec34131625c7071
SHA256

97a2922411f42b6144d30d614aef1a9fc129b8cffbc7c4e2b5eeb7d4afe5cde8
SHA512

e5c07f6c37c60525e2a5965a683bb8b5f00bcb97914452eaea1de19ab38514c836a84d0e4ee7db98cd2c26b8c93e1f6cf383a6e5deaba83ea017447529a9dee1
SSDEEP

3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV2:DPA6wxmuJspr2lb6

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
97a2922411f42b6144d30d614aef1a9fc129b8cffbc7c4e2b5eeb7d4afe5cde8

Files

97a2922411f42b6144d30d614aef1a9fc129b8cffbc7c4e2b5eeb7d4afe5cde8
.exe windows:4 windows x86 arch:x86

94499ec57ca7f8a108e513ffe23240eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord553
ord667
ord595
ord598
ord631
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord534
ProcCallEngine
ord100
ord610
ord655

Sections

UPX0
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE