The binary likely contains encrypted or compressed data. Show sources
| packer_section | name: UPX1, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0018da00, virtual_size: 0x0018e000 |
The executable is compressed using UPX Show sources
| packer_section | name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x005b1000 |
Expresses interest in specific running processes Show sources
| api_process_name | svchost.exe |
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unusual version info supplied for binary Show sources
| anomaly | Microsoft mentioned in LegalCopyright, but not in CompanyName field |
Attempts to connect to a dead IP:Port (1 unique times) Show sources
| network_host_ip | 185.10.68.220:443 (Germany) |
Creates RWX memory Show sources
| injection_rwx_memory | 0x00000040, NtAllocateVirtualMemory or VirtualProtectEx |