a719f205777604e05f432f7652afd59e9a0e1e7fd28e3b9527fab4b85b0ce5f3

Sharing

Copy URL Twitter E-mail

General

Target

a719f205777604e05f432f7652afd59e9a0e1e7fd28e3b9527fab4b85b0ce5f3
Size

624KB
MD5

00759eb4dfc10f28dfc3c7cdacc698f3
SHA1

a7516e07c71ce76ffc27d502b69a46b42b480442
SHA256

a719f205777604e05f432f7652afd59e9a0e1e7fd28e3b9527fab4b85b0ce5f3
SHA512

9cd9a3b0e2386cb06b51d4fafa4d2decc5594b8f9f5c5713cfe336622f7e3eee8674d9ed95c48c6a600070d01dd811d995a490522fff99ff273beb12bf9842eb
SSDEEP

6144:dXxkBOW8l1SCV1eUyq9UEX15Uqeu50So/CcGtTwB2EHf0iU+09biLfDs:pC7uSCVtyu5UqfoNG1wsEHf0iF09

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

a719f205777604e05f432f7652afd59e9a0e1e7fd28e3b9527fab4b85b0ce5f3
.exe windows x86

1c1aedcb2ad6d4f8f7ea065f1a1d2ff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

admin_class_lib

??1CLogAppender@@UAE@XZ
??1CFileLogAppender@@UAE@XZ
??1CEventLogAppender@@UAE@XZ
??0CLog@@QAE@XZ
??0CFileLogAppender@@QAE@W4eSeverity@nsCLog@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1_N@Z
?WriteLog@CFileLogAppender@@UAE_NW4eSeverity@nsCLog@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?WriteLog@CEventLogAppender@@UAE_NW4eSeverity@nsCLog@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?AddAppender@CLog@@UAEHPAVCLogAppender@@@Z
?WriteLog@CLog@@UAEHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4eSeverity@nsCLog@@0@Z
?WriteLog@CLog@@UAEHW4eSeverity@nsCLog@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?WriteLogVariable@CLog@@UAAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4eSeverity@nsCLog@@PB_WZZ
?WriteLogVariable@CLog@@UAAHW4eSeverity@nsCLog@@PB_WZZ
?WriteLogHex@CLog@@UAEHW4eSeverity@nsCLog@@PAEH@Z
?SetSourceName@CLog@@UAEAAV1@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0CCommandLineParameters@@QAE@PB_W0@Z
??1CCommandLineParameters@@QAE@XZ
?GetSwitchStr@CCommandLineParameters@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W0H@Z
?CommandLine@CCommandLineParameters@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

sysenv

HT_ReadINIFileA
HT_ReadINIFileW
HT_WriteINIFileA

edsop

HTOP_SaveEnableOrDisableFlagIntoReg
HTOP_GetStatus

mfc80u

ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord577
ord280
ord293
ord774
ord1472
ord6133
ord283
ord3800
ord268
ord575
ord3249
ord6700
ord282
ord1479
ord899
ord896
ord265
ord777
ord3990
ord5558
ord6166
ord6172
ord6160
ord5524
ord1079
ord1198
ord764
ord762
ord266
ord4535
ord3677
ord1007
ord5096
ord566
ord757
ord3824
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord2239
ord3942
ord4562
ord5226
ord5209
ord5562
ord1049
ord5971
ord3327
ord4255
ord4475
ord3943
ord2638
ord2531
ord2725
ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord776

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_wcsicmp
wcsncat_s
wcsncpy_s
_ultoa_s
atol
_purecall
?what@exception@std@@UBEPBDXZ
wcscpy_s
wcscat_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_CxxThrowException
memset
memmove_s
__CxxFrameHandler3

kernel32

CloseHandle
SetEvent
OpenEventW
MapViewOfFile
OpenFileMappingW
CreateMutexA
OpenMutexA
GetLastError
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ReleaseMutex
LocalFree
LocalAlloc
GetSystemDirectoryW
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
OpenProcess
Process32NextW
DeleteFileW
InterlockedExchange
Sleep
InterlockedCompareExchange

user32

FindWindowA
MessageBoxW
ShowWindow

advapi32

RegQueryValueExW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
SetSecurityDescriptorDacl

shell32

ShellExecuteExW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW

ole32

OleRun
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

GetErrorInfo

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

Exports

Exports

??0CEventLogAppender@@QAE@ABV0@@Z
??0CFileLogAppender@@QAE@ABV0@@Z
??0CLog@@QAE@ABV0@@Z
??0CLogAppender@@QAE@ABV0@@Z
??4CCommandLineParameters@@QAEAAV0@ABV0@@Z
??4CEventLogAppender@@QAEAAV0@ABV0@@Z
??4CFileLogAppender@@QAEAAV0@ABV0@@Z
??4CLog@@QAEAAV0@ABV0@@Z
??4CLogAppender@@QAEAAV0@ABV0@@Z
??_7CEventLogAppender@@6B@
??_7CFileLogAppender@@6B@
??_7CLog@@6B@
??_7CLogAppender@@6B@
??_FCCommandLineParameters@@QAEXXZ
?ParamCount@CCommandLineParameters@@QAEHXZ

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 428KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1c1aedcb2ad6d4f8f7ea065f1a1d2ff2

Headers

File Characteristics

Imports

admin_class_lib

sysenv

edsop

mfc80u

msvcr80

kernel32

user32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp80

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 428KB - Virtual size: 424KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 428KB - Virtual size: 424KB

UPX0
Size: 144KB - Virtual size: 380KB