c3b5a6642caf9ab08ba9a2fed76cd030a07423c76cd00d774bd3c5b74d56649c

Sharing

Copy URL Twitter E-mail

General

Target

c3b5a6642caf9ab08ba9a2fed76cd030a07423c76cd00d774bd3c5b74d56649c
Size

180KB
MD5

646abefbb5b34918e8fc1f098fd09190
SHA1

ccce02632f82d0a0bcb46668c75300803f44b176
SHA256

c3b5a6642caf9ab08ba9a2fed76cd030a07423c76cd00d774bd3c5b74d56649c
SHA512

7af89d5601557e5fd8e091e2c8db3ae2855d83dbfc628dbb4c153d69280f6cb7073eab20201257828669a32ba873d4af38013fdb241ec356cb32da67886060f1
SSDEEP

3072:0R+qhGhTUWOK/sK0HQCCKlhtfxaQp/K7lVNv7uUAz8LGUvfbJQACvtFryS0BNy2A:i+qhO/sNHQCCyhtDEBwz8LNfbJ/CRmyt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

c3b5a6642caf9ab08ba9a2fed76cd030a07423c76cd00d774bd3c5b74d56649c
.exe windows x86

39ffd653303861b3373fdacc91301f95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegSetValueW
RegDeleteKeyW
GetLengthSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenProcessToken
AddAccessAllowedAceEx
ConvertStringSidToSidW

kernel32

LoadLibraryW
SetErrorMode
GetSystemDirectoryW
GetVersionExW
CloseHandle
WriteFile
SizeofResource
CreateFileW
LockResource
LoadResource
FindResourceW
SetFileAttributesW
GetFileAttributesW
Sleep
GetTickCount
CreateProcessW
DeleteFileW
lstrcmpW
FindFirstFileExW
FindClose
FindNextFileW
FindFirstFileW
SetCurrentDirectoryW
FreeLibrary
GetShortPathNameW
GetSystemDefaultUILanguage
CreateDirectoryW
WaitForSingleObject
ExpandEnvironmentStringsW
CompareStringOrdinal
InterlockedDecrement
GetTempFileNameW
GetTempPathW
SetLastError
FindResourceExW
IsWow64Process
GetNativeSystemInfo
GetPrivateProfileStringW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetModuleFileNameW
LocalFree
LocalAlloc
GetModuleHandleW
GetProcAddress
GetVersion
GetEnvironmentVariableW
GetLastError
lstrlenW
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
GetLocaleInfoW
UnmapViewOfFile
GetUserDefaultUILanguage
SearchPathW
LoadLibraryExW

user32

BlockInput
UnhookWinEvent
SetTimer
GetShellWindow
LoadStringW
PostMessageW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
SendInput
GetCursorPos
SystemParametersInfoW
PostQuitMessage
SetWinEventHook
KillTimer
DispatchMessageW
GetMessageW

msvcrt

??1type_info@@UAE@XZ
iswalpha
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
_time64
_vsnwprintf
iswctype
memcpy
wcsncmp
_wcsnicmp
_wcsicmp
bsearch
memcpy_s
wcsrchr
fclose
swscanf_s
fgetws
_controlfp
_except_handler4_common
?terminate@@YAXXZ
memset
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_CxxThrowException
_wfopen_s

shell32

SHGetSpecialFolderPathW
SHSetLocalizedName
SHParseDisplayName
SHGetFolderPathW
SHBindToParent
ord190
ord526
ord165
SHChangeNotify
SHGetSpecialFolderLocation
ord155
SHGetDesktopFolder

ole32

OleUninitialize
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoUninitialize
CoInitializeEx
OleInitialize

ieadvpack

RegRestoreAllW
ExecuteCabW
RunSetupCommandW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

SHRegGetUSValueW
PathIsNetworkPathW
PathCombineW
SHRegGetValueW
SHRegDeleteUSValueW
ord388
StrStrW
ord225
PathRemoveExtensionW
PathFindFileNameW
PathRemoveBlanksW
SHDeleteValueW
SHSetValueW
StrCmpIW
SHGetValueW
SHStrDupW
SHRegSetUSValueW
PathFileExistsW
StrStrIW
ord158
ord437
StrCmpNIW
SHDeleteKeyW
SHCopyKeyW

iertutil

ord650
ord39
ord33
ord57
ord654

oleacc

AccessibleObjectFromEvent

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

39ffd653303861b3373fdacc91301f95

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

ieadvpack

version

shlwapi

iertutil

oleacc

oleaut32

Sections

.text Size: 63KB - Virtual size: 63KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 3KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 63KB - Virtual size: 63KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB

.UPX0
Size: 108KB - Virtual size: 260KB