6d5cce95db4e9e322d4d0edcf0ac6c37abcf51a9bea8d3f827d47a0f6b30915f

General

Target

6d5cce95db4e9e322d4d0edcf0ac6c37abcf51a9bea8d3f827d47a0f6b30915f
Size

192KB
MD5

6f733ed009bc027dd0de448116498b3e
SHA1

341d3f53f5ca5fe4655161ad46be67683c7f9a93
SHA256

6d5cce95db4e9e322d4d0edcf0ac6c37abcf51a9bea8d3f827d47a0f6b30915f
SHA512

18d3d6de7bf3c90786bfeae837ffef62fc6e30fcb14105278b61c7187860e9f337350dfd4f2010c8c68f35a6032c0d84bfb8278c3bc041c44729a96730fef995
SSDEEP

3072:MJ3KSmI+53XAqf8nFyyDyD9AaS0z3pX3ejsPY8kfGk4ic2e7e+xZwVC0aH3rsA:Mxk5XXf8F3D0Aah5eYPY8keO1+e+xZSj

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

6d5cce95db4e9e322d4d0edcf0ac6c37abcf51a9bea8d3f827d47a0f6b30915f
.exe windows x86

fa302e2d11235d136fef4e8823119994

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
CloseHandle
GetCurrentProcess
GetFullPathNameA
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
GetFileSizeEx
GetLastError
FormatMessageA
ExitProcess
TerminateProcess
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
FlushFileBuffers
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa302e2d11235d136fef4e8823119994

Headers

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 1000B

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 1000B

UPX0
Size: 144KB - Virtual size: 380KB