9cc539218b6a905b2de9bf1265410001f0e546c464471cbd127a81a437b019fc

Sharing

Copy URL Twitter E-mail

General

Target

9cc539218b6a905b2de9bf1265410001f0e546c464471cbd127a81a437b019fc
Size

240KB
MD5

141deb5acfff7e9aad6ceb3195da088a
SHA1

7eec77bff8e4ddf0892f61433a081c51408f5679
SHA256

9cc539218b6a905b2de9bf1265410001f0e546c464471cbd127a81a437b019fc
SHA512

cedb9af64f959a2c9677a6219648852980cc571ac212a563527e29ebd43f3aeaea4c543079dc3b21eb43ade440681d9bd2eefcadac02602bd3370b65833226dc
SSDEEP

3072:NDXtEPmgFzyTkD2R53mK1oXYPVc7A7lrKqXR0PbuoBQG0uPbo+JU+:NCPmYF2PhRPVc07JLXAcGLtu+

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

9cc539218b6a905b2de9bf1265410001f0e546c464471cbd127a81a437b019fc
.exe windows x86

e6d96fab8010cc2ab678948b120a1a33

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForSingleObject
CreateProcessA
ReadFile
CreatePipe
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetModuleHandleA
GetProcAddress
FreeLibrary
FindFirstFileA
FindClose
DeleteFileA
GetThreadLocale
GetModuleFileNameA
LoadLibraryA
CreateDirectoryA
GetWindowsDirectoryA
SetHandleInformation
MoveFileA
GetLastError
GetOEMCP
GetACP
CompareStringA
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileAttributesA
SetFilePointer
SetEndOfFile
SetStdHandle
GetStdHandle
SetHandleCount
WriteFile
GetStringTypeW
GetStringTypeA
VirtualFree
HeapReAlloc
HeapDestroy
GetTimeZoneInformation
GetCurrentDirectoryA
GetFullPathNameA
GetExitCodeProcess
SetEnvironmentVariableW
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
LCMapStringW
LCMapStringA
FlushFileBuffers
SetEnvironmentVariableA
GetVersion
HeapCreate
CompareStringW
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
VirtualAlloc
GetFileType
CreateFileA
RtlUnwind
GetStartupInfoA
GetCommandLineA

user32

GetMessageA
MessageBoxA
wsprintfA
ReleaseDC
GetDC
SetWindowPos
GetClientRect
GetDesktopWindow
EndPaint
BeginPaint
PostQuitMessage
DefWindowProcA
DispatchMessageA
LoadCursorA
RegisterClassA
CreateWindowExA
SetTimer
TranslateMessage

gdi32

CreateDIBSection
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetDeviceCaps

advapi32

RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA

wsock32

htons
WSAAsyncSelect
closesocket
WSAStartup
WSAGetLastError
send
connect
ioctlsocket
socket
bind
listen
ntohs
accept
recv
getsockname

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e6d96fab8010cc2ab678948b120a1a33

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

wsock32

Sections

.text Size: 104KB - Virtual size: 101KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 50KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 104KB - Virtual size: 101KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 50KB

.UPX0
Size: 108KB - Virtual size: 260KB