392ef3732ec610f1d97715a6b2edc60f58737e1b588f3e5c3e264001955f4163

Sharing

Copy URL Twitter E-mail

General

Target

392ef3732ec610f1d97715a6b2edc60f58737e1b588f3e5c3e264001955f4163
Size

708KB
MD5

63cec713ff36e4aa4d7ca5628208a150
SHA1

3f4c4a0a4f160262e99b81cf054e6d15411936c9
SHA256

392ef3732ec610f1d97715a6b2edc60f58737e1b588f3e5c3e264001955f4163
SHA512

255b15bda08c7e178ef81c019147f6dc81295f2163c18c5d7701e82b26700433ed6c16d5273aca4c4dc241000e927725435319aee8bd4b9a794207f2ea8d6d8e
SSDEEP

12288:I2/7+kRdWUA3v/pEGumkfKEvIGJM62S8ZM98hsdC2cDxS60CnRnTqIyLSFTs:eq98hsMt0CnRntF

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

392ef3732ec610f1d97715a6b2edc60f58737e1b588f3e5c3e264001955f4163
.exe windows x86

446362bea8b299c7ee18a6fda8488a10

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
getservbyname
htons
htonl
WSAGetLastError
gethostbyaddr
inet_addr
ntohs
getservbyport
WSASetLastError
inet_ntoa
WSACleanup
gethostbyname

kernel32

SetFilePointer
FlushFileBuffers
DuplicateHandle
UnlockFile
SetEndOfFile
WriteFile
LockFile
GetVolumeInformationA
GetCurrentDirectoryA
GetThreadLocale
GetFileSize
GetFileTime
GetFullPathNameA
GetFileAttributesA
GetTickCount
RtlUnwind
RaiseException
GetTimeZoneInformation
SetStdHandle
GetFileType
GetCPInfo
GetOEMCP
GetACP
HeapReAlloc
HeapSize
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
FileTimeToLocalFileTime
SetErrorMode
IsBadWritePtr
UnhandledExceptionFilter
GetProcessVersion
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetStringTypeA
GetStringTypeW
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
SizeofResource
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GetLocalTime
GetSystemTime
GlobalHandle
GetModuleHandleA
GetProcAddress
GetCurrentProcess
LocalAlloc
LocalFree
CloseHandle
GetEnvironmentVariableA
WinExec
GetCommandLineA
CreateMutexA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileSectionA
WritePrivateProfileStringA
ExitProcess
GetLastError
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTempPathA
GetModuleFileNameA
GetProfileStringA
TlsAlloc
lstrcpynA
FileTimeToSystemTime
FindClose
FindNextFileA
FindFirstFileA
MulDiv
GlobalAlloc
GetCurrentThread
GlobalGetAtomNameA
SetLastError
GetCurrentThreadId
GlobalFindAtomA
lstrcmpiA
GlobalAddAtomA
GlobalUnlock
GlobalDeleteAtom
GlobalLock
FindResourceA
GlobalFree
LockResource
WideCharToMultiByte
LoadResource
MultiByteToWideChar
InterlockedIncrement
lstrlenA
InterlockedDecrement
HeapAlloc
GetVersion
GetProcessHeap
SuspendThread
HeapFree
ResumeThread
lstrcmpA
DeviceIoControl
GetSystemDirectoryA
CreateFileA
FormatMessageA
ReleaseMutex
LoadLibraryA
ReadFile
GetVersionExA
lstrcpyA
FreeLibrary
OutputDebugStringA
DeleteCriticalSection
lstrcatA
GetWindowsDirectoryA
TerminateThread
WaitForSingleObject
GetExitCodeThread
CreateThread
GetCurrentProcessId
Sleep
VirtualFree
CreateProcessA
VirtualAlloc
GetStartupInfoA
TerminateProcess
FreeEnvironmentStringsA

user32

GetWindowDC
LoadAcceleratorsA
TranslateAcceleratorA
ReleaseCapture
DestroyMenu
SetMenu
ReuseDDElParam
UnpackDDElParam
InvalidateRect
BringWindowToTop
LoadStringA
PtInRect
GetSysColorBrush
CharNextA
CopyAcceleratorTableA
GetNextDlgGroupItem
MessageBeep
CharUpperA
InflateRect
RegisterClipboardFormatA
PostThreadMessageA
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
MapDialogRect
SetRectEmpty
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
GetSysColor
DispatchMessageA
GetFocus
SetFocus
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
BeginPaint
TranslateMessage
GetTopWindow
MessageBoxA
IsChild
PostQuitMessage
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetMenuItemID
GetWindowTextA
GetDlgCtrlID
GetKeyState
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetWindow
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetParent
GetDlgItem
IsWindowEnabled
UnhookWindowsHookEx
SetRect
LoadMenuA
GetSubMenu
EnableMenuItem
CheckMenuItem
AppendMenuA
DeleteMenu
GetCursorPos
TrackPopupMenu
SetMenuDefaultItem
ReleaseDC
GetDC
GetClientRect
GetSystemMetrics
GetDesktopWindow
GetShellWindow
FindWindowExA
GetForegroundWindow
GetWindowTextLengthA
IsWindow
IsIconic
IsWindowVisible
EnumChildWindows
SystemParametersInfoA
GetClassNameA
GetWindowRect
SetForegroundWindow
KillTimer
SetTimer
PostMessageA
SendMessageTimeoutA
SetWindowContextHelpId
GetMessageA
ShowOwnedPopups
ValidateRect
SetCursor
GetCapture
OpenInputDesktop
CloseDesktop
GetWindowLongA
LoadImageA
RegisterWindowMessageA
RegisterDeviceNotificationA
LoadIconA
LoadCursorA
FindWindowA
SendMessageA
EnableWindow
wsprintfA
SetPropA
GetClassLongA
PeekMessageA
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
IsWindowUnicode

gdi32

SetBkColor
SetTextColor
GetClipBox
GetObjectA
CreateDIBitmap
Rectangle
GetWindowExtEx
GetTextExtentPointA
BitBlt
CreateCompatibleDC
GetPixel
DeleteObject
GetDeviceCaps
GetViewportExtEx
CreatePen
PtVisible
RectVisible
ExtTextOutA
Escape
TextOutA
GetBkColor
DPtoLP
GetTextColor
LPtoDP
PatBlt
GetMapMode
IntersectClipRect
ScaleWindowExtEx
SetWindowExtEx
SetViewportExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
SetMapMode
SetViewportOrgEx
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
CreateSolidBrush

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
ord201
ClosePrinter
GetPrinterA
OpenPrinterA
FindClosePrinterChangeNotification
FreePrinterNotifyInfo
EnumPortsA
EnumPrintersA

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegEnumValueA
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
GetSidSubAuthority
RegEnumKeyA
RegQueryInfoKeyA

shell32

DragFinish
DragQueryFileA
Shell_NotifyIconA
SHAppBarMessage

comctl32

ord17

oledlg

ord8

ole32

OleFlushClipboard
OleIsCurrentClipboard
CLSIDFromString
CoRegisterMessageFilter
OleUninitialize
OleInitialize
CLSIDFromProgID
CoRevokeClassObject
StgCreateDocfileOnILockBytes
CoGetClassObject
StgOpenStorageOnILockBytes
CoTaskMemAlloc
CreateILockBytesOnHGlobal
CoTaskMemFree
CoFreeUnusedLibraries

olepro32

ord253

oleaut32

VariantCopy
SysFreeString
VariantChangeType
SysAllocStringByteLen
SysAllocString
VariantClear
VariantTimeToSystemTime
SysAllocStringLen
SysStringLen

Sections

.text
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

446362bea8b299c7ee18a6fda8488a10

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 308KB - Virtual size: 307KB

.rdata Size: 52KB - Virtual size: 50KB

.data Size: 48KB - Virtual size: 82KB

.rsrc Size: 188KB - Virtual size: 185KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 308KB - Virtual size: 307KB

.rdata
Size: 52KB - Virtual size: 50KB

.data
Size: 48KB - Virtual size: 82KB

.rsrc
Size: 188KB - Virtual size: 185KB

.UPX0
Size: 108KB - Virtual size: 260KB