d7150806da42fd91dc5dbe1c88719fa7dbc36faa6a5ed9d9cdc143dd00c5fff5

Sharing

Copy URL Twitter E-mail

General

Target

d7150806da42fd91dc5dbe1c88719fa7dbc36faa6a5ed9d9cdc143dd00c5fff5
Size

412KB
MD5

7148e85bb9c86c0e763a8dbbc13b3ca8
SHA1

fc1a0d064c1cd8de2e261161c20e424afe2f2a9a
SHA256

d7150806da42fd91dc5dbe1c88719fa7dbc36faa6a5ed9d9cdc143dd00c5fff5
SHA512

7fe545ed589b003a30c007fa3ca879210f86d31e9c00bc3337c182caaf833fd8e40842ff7641e2bd69614fddcf5f677441c8b5891a57b125e804a1b2cfe336c2
SSDEEP

6144:m9yotk21HCPpRAl3PKYwMd6gOUPFqjrEXXTQZfNy4F825cMxZ8RoMiFFFLSrrAyI:mc5mHMqPKYD/XXTQZfN86bZ8RqaAyFqt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

d7150806da42fd91dc5dbe1c88719fa7dbc36faa6a5ed9d9cdc143dd00c5fff5
.exe windows x86

db9dfb1773420ff1c0996ce4eb05fbac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathIsUNCA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathRemoveFileSpecA
SHDeleteKeyA

kernel32

GetProcessHeap
GetStartupInfoA
ExitThread
CreateThread
HeapReAlloc
HeapSize
GetStdHandle
VirtualFree
IsBadWritePtr
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
GetLocaleInfoW
GetCommandLineA
HeapFree
HeapAlloc
VirtualQuery
GetSystemInfo
GetVersionExA
GetLastError
GetCurrentProcess
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetModuleFileNameA
GlobalFree
CloseHandle
GlobalAlloc
Sleep
FindResourceA
SizeofResource
LockResource
LoadResource
WideCharToMultiByte
DeleteFileA
GetExitCodeProcess
WaitForSingleObject
GetVersion
MultiByteToWideChar
CompareStringW
CompareStringA
lstrcmpiA
lstrlenA
ReadFile
WriteFile
CreateFileA
SetFilePointer
DeviceIoControl
ResumeThread
GetCurrentThreadId
SetEvent
VirtualAlloc
VirtualProtect
ExitProcess
SetCurrentDirectoryA
SetEnvironmentVariableA
RtlUnwind
GetTickCount
GetFileTime
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
GetOEMCP
GetCPInfo
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentDirectoryA
WritePrivateProfileStringA
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RaiseException
InterlockedDecrement
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
FreeResource
GlobalAddAtomA
GetCurrentThread
FreeLibrary
GlobalDeleteAtom
lstrcmpA
GetModuleHandleA
GetProcAddress
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
LoadLibraryA
SetLastError
MulDiv
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
CreateEventA
SuspendThread

user32

PostThreadMessageA
RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
wsprintfA
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
UpdateWindow
PostMessageA
ExitWindowsEx
GetSystemMetrics
SetForegroundWindow
DrawIcon
SendMessageA
IsIconic
GetClientRect
IsWindowVisible
SetTimer
KillTimer
FindWindowExA
EnableWindow
LoadIconA
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
MessageBoxA
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
CharUpperA
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
GetMenuItemID
GetSubMenu
LoadMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
SetMenuItemBitmaps
ValidateRect
PeekMessageA
GetKeyState
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
GetMenuItemCount

gdi32

ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
GetStockObject
SetWindowExtEx
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
RestoreDC
SaveDC
GetObjectA
SetBkColor
GetDeviceCaps
GetBkColor
CreateBitmap
SetTextColor
GetClipBox
SetMapMode

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyA
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
AdjustTokenPrivileges
GetTokenInformation
AllocateAndInitializeSid
EqualSid
LookupAccountSidA
FreeSid

shell32

ShellExecuteExA
Shell_NotifyIconA

comctl32

ord17

oledlg

ord8

ole32

StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CreateILockBytesOnHGlobal
CoTaskMemFree
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
CoTaskMemAlloc
OleIsCurrentClipboard

oleaut32

SysAllocStringLen
SysStringLen
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy
SysFreeString

Sections

.text
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

db9dfb1773420ff1c0996ce4eb05fbac

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

Sections

.text Size: 204KB - Virtual size: 200KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 36KB - Virtual size: 33KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 204KB - Virtual size: 200KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 36KB - Virtual size: 33KB

.UPX0
Size: 104KB - Virtual size: 252KB