7f0896f91ea5b2ee8dd01b62e6725551623f4dde5c5aad3551d0e3963f8687f2

Sharing

Copy URL Twitter E-mail

General

Target

7f0896f91ea5b2ee8dd01b62e6725551623f4dde5c5aad3551d0e3963f8687f2
Size

272KB
MD5

1f327133fdfabc0756ad1a75dcf8dfae
SHA1

578ecc1f949b99de4dd3a34d51c593e8bafc1760
SHA256

7f0896f91ea5b2ee8dd01b62e6725551623f4dde5c5aad3551d0e3963f8687f2
SHA512

42a5fcd70cea30ccf03ccfe5db83635f3b20f702e5dec69c25693105fc5dec3a9785171659f105196a9ac9f9a231359fb326b9e54c8c09aee48f58aaeee5f9a5
SSDEEP

6144:CQlembRN8T2z9lwr1R6XdU9q/DMhUsAVD:teGRN8T2v2sXdH8bAVD

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

7f0896f91ea5b2ee8dd01b62e6725551623f4dde5c5aad3551d0e3963f8687f2
.exe windows x86

fe45108966e6acf3c821036e7916969f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

kernel32

RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
CloseHandle
RegisterApplicationRestart
HeapSetInformation
GetModuleHandleW
GetLastError
CreateMutexW
GetCurrentThreadId
SetEvent
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
SetLastError
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
GetDateFormatW
GetTimeFormatW
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
CompareFileTime
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
InterlockedExchange
GetVersionExA
OutputDebugStringA

user32

GetClassInfoExW
LoadCursorW
PostMessageW
DefWindowProcW
RegisterClassExW
SetTimer
SetWindowLongW
GetWindowLongW
CreateWindowExW
LoadStringW
KillTimer
PostThreadMessageW
DispatchMessageW
GetMessageW
TranslateMessage
CallWindowProcW
UnregisterClassA

msvcrt

_controlfp
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
free
memset
_vsnwprintf
memcpy
_purecall
swprintf_s
??2@YAPAXI@Z
__CxxFrameHandler3
??3@YAXPAX@Z
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs

ole32

CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

Exports

Exports

Microsoft_WDF_UMDF_Version

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fe45108966e6acf3c821036e7916969f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 129KB - Virtual size: 128KB

.reloc Size: 3KB - Virtual size: 2KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 129KB - Virtual size: 128KB

.reloc
Size: 3KB - Virtual size: 2KB

.UPX0
Size: 108KB - Virtual size: 260KB