5060c4b58ed2ee37d051deb8f667e71aca8c1817b6d6d765a96fcac847601b7e

Sharing

Copy URL Twitter E-mail

General

Target

5060c4b58ed2ee37d051deb8f667e71aca8c1817b6d6d765a96fcac847601b7e
Size

440KB
MD5

171f64528cad44ac8fa4e5ad28794d1e
SHA1

66ed6e9e526379c7d54db18ed51fce81a844d71c
SHA256

5060c4b58ed2ee37d051deb8f667e71aca8c1817b6d6d765a96fcac847601b7e
SHA512

dc6bf618e3cae537df41ae23ce1ae2072e9f848ec6130557a711e2eda0fcb66e214468cf604390a2eeeaafdef83d025e414d2594c83a8066d867fed80c6db012
SSDEEP

12288:VGutcTrqLGg+atfuzIYdkH2taLxa1F/efQ0:lc6LGgFtfucYmi

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

5060c4b58ed2ee37d051deb8f667e71aca8c1817b6d6d765a96fcac847601b7e
.exe windows x86

0433dfc93c1a9ab786e64ea0244d315a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

wsock32

socket
connect
inet_ntoa
ioctlsocket
gethostbyname
htons
WSAGetLastError
WSAStartup
WSACleanup
recv
select
__WSAFDIsSet
send
closesocket

odbc32

ord19
ord11
ord18
ord13
ord4
ord29
ord45
ord41
ord9
ord24
ord75
ord31
ord36

kernel32

SetEnvironmentVariableA
GetLocaleInfoW
InterlockedDecrement
CompareStringW
CompareStringA
LoadLibraryA
CreateProcessA
GetExitCodeProcess
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetCPInfo
GetLocaleInfoA
InterlockedExchange
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
HeapSize
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
SetStdHandle
GetStartupInfoA
GetStdHandle
SetHandleCount
FlushFileBuffers
SetUnhandledExceptionFilter
TlsGetValue
CreateMutexA
ReleaseMutex
WaitForSingleObject
RemoveDirectoryA
CreateDirectoryA
CloseHandle
GetLastError
SetLastError
WriteFile
ReadFile
CreateFileA
SetFilePointer
SetEndOfFile
FindFirstFileA
FindClose
FindNextFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
Sleep
GetSystemTimeAsFileTime
DeleteFileA
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
RtlUnwind
RaiseException
GetFileAttributesA
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
HeapFree
HeapAlloc
HeapReAlloc
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCommandLineA
GetVersionExA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileType
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
TlsAlloc
TlsFree
TlsSetValue

Sections

.text
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX0
Size: 148KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0433dfc93c1a9ab786e64ea0244d315a

Headers

File Characteristics

Imports

advapi32

wsock32

odbc32

kernel32

Sections

.text Size: 224KB - Virtual size: 220KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 8KB - Virtual size: 82KB

UPX0 Size: 148KB - Virtual size: 384KB

.text
Size: 224KB - Virtual size: 220KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 8KB - Virtual size: 82KB

UPX0
Size: 148KB - Virtual size: 384KB