ffa7ab4ecec414d113ad60e07bdc429eeed19ef0484455e857de72875ab7cdbd

Sharing

Copy URL Twitter E-mail

General

Target

ffa7ab4ecec414d113ad60e07bdc429eeed19ef0484455e857de72875ab7cdbd
Size

348KB
MD5

6d4ca8dcf9942819a972c3464e02a15a
SHA1

f9fe0a0c74e85ea45437fa2249e74cb200956c6a
SHA256

ffa7ab4ecec414d113ad60e07bdc429eeed19ef0484455e857de72875ab7cdbd
SHA512

84b7278ed14c459abad968f5e20b76446ee121881f3eed305552279a0104b00801c390c358ff5fdbfde09ff3263ac67e62f09fc6bbdc5f30faa1e051e802ab7e
SSDEEP

6144:M+wP3nzIl/uNRjhR7uRB71FHGgrgQxc/rjuRpxk/N:7lm/jhduX1FHGgrK/PuRCN

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

ffa7ab4ecec414d113ad60e07bdc429eeed19ef0484455e857de72875ab7cdbd
.exe windows x86

876462491a90458b4a726d9305aff8b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

iswalnum
strstr
strchr
memmove
malloc
_itow
_wtol
strncpy
iswalpha
_wtoi
_vsnprintf
_wcsicmp
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsstr
wcsrchr
_wcslwr
_wcsupr
strncat
wcsncmp
_wcsnicmp
wcschr
wcscmp
mbstowcs
free
wcsncat
wcsncpy
swscanf
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_vsnwprintf

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegEnumValueW
RegEnumValueA
RegEnumKeyW
RegEnumKeyA
RegCreateKeyExA
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CreateProcessW
CreateProcessA
GetShortPathNameW
GetShortPathNameA
GetWindowsDirectoryW
GetCurrentThreadId
CreateFileMappingW
CreateFileMappingA
GetVersionExW
WritePrivateProfileStringW
WritePrivateProfileStringA
SetFileAttributesW
SetFileAttributesA
IsBadWritePtr
MoveFileW
MoveFileA
MoveFileExW
MoveFileExA
LoadLibraryExW
LoadLibraryExA
LoadLibraryA
GetTempPathW
GetTempPathA
GetPrivateProfileStringW
GetPrivateProfileStringA
lstrcpynW
GetModuleHandleW
GetFileAttributesW
GetCurrentDirectoryW
GetCurrentDirectoryA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
GetProfileStringA
GetProfileStringW
GetSystemDirectoryA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
DeleteFileW
DeleteFileA
CreateFileW
CreateDirectoryW
CopyFileW
CopyFileA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
WriteFile
MapViewOfFile
UnmapViewOfFile
GetTickCount
QueryPerformanceCounter
FreeLibrary
FindClose
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetLastError
GetModuleHandleA
GetProcAddress
SetLastError
LocalFree
GetSystemDirectoryW
RemoveDirectoryA
RemoveDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
WriteProfileStringA
WriteProfileStringW
GetStartupInfoA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryW
GetCurrentProcessId
CloseHandle
GetFileAttributesA
GetVersionExA
GetTimeZoneInformation
GetFileTime
GetExitCodeProcess
WaitForMultipleObjects
GetCommandLineW
GetFileSize
CreateFileA
GetWindowsDirectoryA
CreateDirectoryA
SetEndOfFile
SetFilePointer

ole32

CoCreateGuid
CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
StringFromGUID2

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime

shell32

SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListA
ShellExecuteA
ShellExecuteW
SHGetSpecialFolderPathA
SHGetMalloc

shlwapi

PathRemoveBlanksW
PathAppendW
PathRemoveFileSpecW
PathIsDirectoryW

user32

LoadStringA
LoadStringW
PostMessageA
PostMessageW
RegisterWindowMessageA
SendMessageA
IsWindow
CharNextA

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

876462491a90458b4a726d9305aff8b3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

shlwapi

user32

version

Sections

.text Size: 180KB - Virtual size: 178KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 16KB - Virtual size: 15KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 180KB - Virtual size: 178KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 16KB - Virtual size: 15KB

UPX0
Size: 144KB - Virtual size: 380KB