47d1a7c38f3dbfa0f86a045da7757ec1359a02079d763fb6e8991a6f25c787ad

Sharing

Copy URL Twitter E-mail

General

Target

47d1a7c38f3dbfa0f86a045da7757ec1359a02079d763fb6e8991a6f25c787ad
Size

571KB
MD5

584db81769e7f4d4c8c85761ae932813
SHA1

f740442a9a5b04f8fb280d7549c2828f5f478829
SHA256

47d1a7c38f3dbfa0f86a045da7757ec1359a02079d763fb6e8991a6f25c787ad
SHA512

42065cca15e3abbce6e556218cbdc746bfd825809cfedc1929fd8a307067299502ee4ab722bfe9e792c5f7b098ff53a5fdb648949858adbd15895f4e7841866d
SSDEEP

12288:4EZPxgg8YuejgTBmO4uSeK+fVlX3mpySt6:4EVxgg8Yue8t7WkVlX2ptt6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

47d1a7c38f3dbfa0f86a045da7757ec1359a02079d763fb6e8991a6f25c787ad
.exe windows x86

2f0f41cb27dbf82d68f2f5394511a6a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

atl

ord23
ord21
ord20
ord22
ord18
ord17
ord16
ord32

kernel32

SetEvent
InterlockedDecrement
CloseHandle
WaitForSingleObject
CreateThread
CreateEventA
GetSystemWindowsDirectoryA
Sleep
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
SetUnhandledExceptionFilter
FreeLibrary
GetProcAddress
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
LeaveCriticalSection
IsBadCodePtr
EnterCriticalSection
TerminateThread
ResetEvent
WideCharToMultiByte
MultiByteToWideChar
WaitForMultipleObjects
lstrlenA
GetLastError
GlobalAlloc
GlobalFree
lstrlenW
GetTickCount
GetModuleHandleA
GetStartupInfoA

user32

CharNextA
PostThreadMessageA
GetMessageA
PeekMessageA
MsgWaitForMultipleObjects
UnregisterClassA
DestroyWindow
PostMessageA
DefWindowProcA
CreateWindowExA
RegisterClassA
DispatchMessageA

ole32

CoUninitialize
CoResumeClassObjects
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoTaskMemRealloc
CoSuspendClassObjects

oleaut32

SafeArrayAccessData
SysAllocString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayDestroy
SysAllocStringLen
SysStringLen
VariantInit
SafeArrayCreate
SafeArrayUnaccessData
VariantClear
SysFreeString
SysStringByteLen

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

msvcrt

__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
atof
time
localtime
_initterm
free
wcscpy
strcmp
memcmp
wcstombs
_ftol
fabs
floor
strncpy
strchr
wcslen
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??0exception@@QAE@ABV0@@Z
strcat
strlen
memcpy
??2@YAPAXI@Z
_purecall
memset
_CxxThrowException

Sections

.text
Size: 431KB - Virtual size: 430KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2f0f41cb27dbf82d68f2f5394511a6a9

Headers

File Characteristics

Imports

atl

kernel32

user32

ole32

oleaut32

msvcp60

msvcrt

Sections

.text Size: 431KB - Virtual size: 430KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 15KB - Virtual size: 14KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 431KB - Virtual size: 430KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 15KB - Virtual size: 14KB

.UPX0
Size: 108KB - Virtual size: 260KB