c082b0c88ada4379384b9042e86eda9fbde700083f2bc30e7c861669973dc6d1

Sharing

Copy URL Twitter E-mail

General

Target

c082b0c88ada4379384b9042e86eda9fbde700083f2bc30e7c861669973dc6d1
Size

120KB
MD5

067377ecb1e66bfe6a62f3420d4de920
SHA1

a1cf63c1ddd8797ed787ec5bccf32c8b35239dab
SHA256

c082b0c88ada4379384b9042e86eda9fbde700083f2bc30e7c861669973dc6d1
SHA512

2bc2b5c99b1676368973f58f56c48ed4fa0e0deead173042f6b129dc419ae23e87d716f578243a86ff38c9885f7077e1b3889ce46b3722f09a749abf1c97aea1
SSDEEP

3072:S1stlkL7JANZJlKtBiarsnsNW9o5OlvngwUY:MnqNTnsNw3lvR

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

c082b0c88ada4379384b9042e86eda9fbde700083f2bc30e7c861669973dc6d1
.exe windows x86

46c88ff5286cefa5f7eee35d88b76497

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

SymUnDName
SymGetSymFromAddr
SymSetOptions
SymInitialize
SymGetModuleBase
SymFunctionTableAccess
SymGetModuleInfo
SymCleanup
StackWalk

atl71

ord17
ord20
ord49
ord32
ord23
ord61
ord58
ord31
ord30
ord18
ord64
ord22

sqlunirl

_FormatMessage@28
_GetProcAddress_@8
_GetVersionEx@4
_GetUnicodeRedirectionLayer@0
_LoadString@16

kernel32

lstrcpyA
ExpandEnvironmentStringsA
LoadLibraryA
GetModuleFileNameA
FormatMessageA
GetLastError
GetSystemDefaultLangID
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
LeaveCriticalSection
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
ResetEvent
SetEvent
GetModuleHandleA
GetSystemInfo
SetFilePointer
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetErrorMode
QueryPerformanceFrequency
GlobalMemoryStatus
WriteFile
lstrlenA
HeapFree
FlushFileBuffers
ReadProcessMemory
HeapAlloc
GetProcessHeap
GetCurrentProcess
GetEnvironmentVariableA
CreateFileA
InterlockedIncrement
InterlockedDecrement
WaitForMultipleObjects
WaitForSingleObject
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
AllocConsole
GetStdHandle
GetCurrentThreadId
CreateEventA
GetCommandLineA
RaiseException
GetSystemDefaultLCID
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection

user32

wsprintfA
MessageBoxA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CopySid
RegSetValueExA
GetLengthSid
IsValidSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
OpenProcessToken
MakeSelfRelativeSD
GetSecurityDescriptorLength

ole32

CoRevokeClassObject
CoCreateInstance
CoRegisterClassObject
CoUninitialize
CoInitializeSecurity
CoInitializeEx

oleaut32

SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString

msvcp71

?_Nomemory@std@@YAXXZ

msvcr71

_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_callnewh
memset
_resetstkoflw
_iob
freopen
printf
?terminate@@YAXXZ
_amsg_exit
_stricmp
wcsncat
wcslen
wcscpy
wcsncpy
wcschr
sprintf
??3@YAXPAX@Z
_CxxThrowException
_vsnwprintf
free
malloc
wprintf
_except_handler3
??_V@YAXPAX@Z
strchr
asctime
localtime
time
_strnicmp
_purecall
fclose

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

46c88ff5286cefa5f7eee35d88b76497

Headers

File Characteristics

Imports

imagehlp

atl71

sqlunirl

kernel32

user32

advapi32

ole32

oleaut32

msvcp71

msvcr71

Sections

.text Size: 36KB - Virtual size: 34KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 8KB - Virtual size: 6KB

.UPX Size: 60KB - Virtual size: 60KB

.text
Size: 36KB - Virtual size: 34KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 8KB - Virtual size: 6KB

.UPX
Size: 60KB - Virtual size: 60KB