ec6e80c14a85cb78753030d505e4ea9f19de1062db3f56d19b2a5086f5719f9e

Sharing

Copy URL Twitter E-mail

General

Target

ec6e80c14a85cb78753030d505e4ea9f19de1062db3f56d19b2a5086f5719f9e
Size

800KB
MD5

58fc7fa7f2ca50c46240343da0d68f90
SHA1

c22d4a2954aa0883829fc5a31ecc5c61697cb2a0
SHA256

ec6e80c14a85cb78753030d505e4ea9f19de1062db3f56d19b2a5086f5719f9e
SHA512

f7298ed9fb4eee7fbeac292379114bbee9e824c6bfe5e788a0c884833f812b30199d7507108b3247f9789816213523abb694c98afc34efaeb39be2c3b398bac6
SSDEEP

12288:llqdoibrvzdMYkBckbCAVDcSI9d5TukQyKETw1Jo3n2:+XAb9VU9dgkQyKETw1CX

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

ec6e80c14a85cb78753030d505e4ea9f19de1062db3f56d19b2a5086f5719f9e
.exe windows x86

3f7650258242ba69432a7c4a148ce2c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
OutputDebugStringW
GetProcAddress
LoadLibraryW
GetPrivateProfileStringW
GetCommandLineW
MapViewOfFile
GetLastError
CreateFileMappingW
CloseHandle
UnmapViewOfFile
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
GetTickCount
GetPrivateProfileIntW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
OpenProcess
WritePrivateProfileStringW
OpenMutexW
CreateMutexW
GetCurrentProcess
CreateFileW
GetLocalTime
GetFileAttributesW
DeleteFileW
SetFileAttributesW
InitializeCriticalSection
FlushInstructionCache
VirtualAlloc
DeleteCriticalSection
VirtualFree
EnterCriticalSection
LeaveCriticalSection
GetExitCodeProcess
lstrlenA
MultiByteToWideChar
GetLocaleInfoW
GetVersionExW
CreateDirectoryW
WideCharToMultiByte
ExitProcess
GenerateConsoleCtrlEvent
CopyFileA
CreateDirectoryA
GetFileAttributesA
GetFileSize
FlushFileBuffers
ReadFile
WriteFile
DeleteFileA
CreateFileA
UnlockFileEx
UnlockFile
LockFileEx
LockFile
Module32First
GetVersionExA
GetSystemInfo
Process32First
Process32Next
SetFilePointer
SetEndOfFile
LoadLibraryA
TlsAlloc
InterlockedIncrement
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
SleepEx
GetModuleHandleA
VirtualAllocEx
WriteProcessMemory
CreateEventW
SearchPathW
DuplicateHandle
CreateProcessW
WaitForSingleObject
TerminateProcess
HeapFree
GetStartupInfoA
GetProcessHeap
HeapAlloc
SetErrorMode
VirtualQuery
InterlockedExchange
Sleep

user32

TranslateMessage
GetMessageW
BringWindowToTop
ShowWindow
GetWindowThreadProcessId
MessageBoxW
KillTimer
AppendMenuW
LoadImageW
CreatePopupMenu
TrackPopupMenu
GetCursorPos
GetForegroundWindow
DispatchMessageW
EnumWindows
GetWindowPlacement
SetForegroundWindow
SetWindowPos
IsWindowVisible
GetParent
DestroyWindow
SetWindowLongW
PeekMessageW
CreateWindowExW
DefWindowProcW
GetWindowLongW
SetCursor
PostQuitMessage
ClipCursor
IsWindow

shell32

SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoUninitialize
CoCreateInstance
CoInitialize

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ws2_32

recv
WSAStartup
WSACleanup
gethostbyname
htons
getsockopt
ntohs
__WSAFDIsSet
select
inet_addr
htonl
ntohl
socket
setsockopt
ioctlsocket
listen
bind
WSAGetLastError
connect
accept
closesocket
send
inet_ntoa

dbghelp

MiniDumpWriteDump

msvcrt

__CxxFrameHandler
_purecall
wcsncpy
wcslen
wcschr
_vsnwprintf
wcsrchr
??2@YAPAXI@Z
wcsncat
memset
memcpy
printf
_wfopen
fread
ftell
fseek
fclose
malloc
free
_snwprintf
srand
time
_wcsicmp
_wmkdir
wcsstr
wcscmp
setlocale
_waccess
_wtoi
swscanf
_wcslwr
_wtol
memmove
_ftol
strncpy
strlen
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
rand
_snprintf
calloc
swprintf
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
signal
fflush
fopen
fscanf
_mkdir
_getcwd
_stat
_fstat
_iob
sprintf
_stricmp
_utime
_close
_open
_strdup
_strnicmp
_chdir
_fullpath
_get_osfhandle
getenv
_pclose
_popen
_pipe
_lseeki64
strrchr
_vsnprintf
vfprintf
fprintf
mktime
wcstombs
mbstowcs
localtime
gmtime
asctime
_errno
strstr
memchr
atoi
strspn
__mb_cur_max
_isctype
_pctype
tolower
strchr
strtol
strtod
atof
toupper

winmm

timeBeginPeriod
timeGetDevCaps
timeKillEvent
timeSetEvent

Sections

.text
Size: 576KB - Virtual size: 574KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3f7650258242ba69432a7c4a148ce2c5

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

psapi

version

ws2_32

dbghelp

msvcrt

winmm

Sections

.text Size: 576KB - Virtual size: 574KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 64KB - Virtual size: 81KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 44KB - Virtual size: 42KB

.reloc Size: 16KB - Virtual size: 12KB

.UPX Size: 60KB - Virtual size: 60KB

.text
Size: 576KB - Virtual size: 574KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 64KB - Virtual size: 81KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 44KB - Virtual size: 42KB

.reloc
Size: 16KB - Virtual size: 12KB

.UPX
Size: 60KB - Virtual size: 60KB