7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd

Sharing

Copy URL

Twitter E-mail

General

Target

7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd
Size

1.1MB
MD5

129ace256116b6572024b79bb2fa39ef
SHA1

7de3aa0adcdac2ac708e245bfe1f301170404899
SHA256

7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd
SHA512

fa02cca7c149206e397b7e082134ba36768d79db069955f51d04347512176b9578804de14087620ee2df3e9c27828eebf70b40b2157a74eee6dd5b36a734527a
SSDEEP

24576:InIE6iLcaqq9tH98ffJDtZjKARcmCBxTCcjAwhuZuPOYv8b:2dLcaq8cfJDtpK8czTRhuZuWqS

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd
.exe windows x86

4bbc99181e3a8a6bd6382222e896099b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObjectEx
CreateNamedPipeW
GetOverlappedResult
DisconnectNamedPipe
ReadFileEx
WriteFileEx
GlobalAlloc
ExitThread
SetLastError
GlobalFree
DuplicateHandle
LocalFree
CreateThread
OpenEventW
MoveFileExW
CreateDirectoryW
CopyFileW
FileTimeToSystemTime
DeleteFileW
SetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
OpenMutexW
FindFirstFileW
FindClose
LocalAlloc
FindNextFileW
GetSystemDirectoryW
RemoveDirectoryW
GetFileSize
ReadFile
FlushFileBuffers
GlobalLock
GlobalUnlock
GlobalHandle
CreateFileA
CreateFileMappingA
OpenFileMappingA
GetWindowsDirectoryA
DeleteFileA
HeapAlloc
HeapReAlloc
ExitProcess
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetDriveTypeW
ResumeThread
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetFileType
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ConnectNamedPipe
LoadLibraryA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
QueryPerformanceCounter
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
LCMapStringW
GetModuleHandleA
GetFullPathNameA
SetStdHandle
GetConsoleCP
GetConsoleMode
SetEndOfFile
GetProcessHeap
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTempPathW
GetCommandLineW
ReleaseMutex
DeleteCriticalSection
CreateEventW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetTickCount
SetEvent
InterlockedCompareExchange
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
CreateMutexW
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
lstrcpyW
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
lstrcatW
GetLocalTime
CreateFileW
GetModuleFileNameW
FormatMessageW
WriteFile
GetModuleHandleW
GetCurrentProcess
SetUnhandledExceptionFilter
CreateProcessW
VirtualQuery
SetFilePointer
HeapSize
GetWindowsDirectoryW
CloseHandle
QueryDosDeviceW
GetProcAddress
GetLastError
LoadLibraryW
OpenProcess
GetLogicalDriveStringsW
FreeLibrary
WaitForMultipleObjects
HeapFree
Sleep

user32

GetAsyncKeyState
IntersectRect
GetCursorPos
ReleaseCapture
GetMonitorInfoW
GetParent
TrackMouseEvent
SetWindowLongW
EnableWindow
CallWindowProcW
DefWindowProcW
MoveWindow
FillRect
GetDC
ReleaseDC
DestroyWindow
SetCursor
RegisterClassExW
SetWindowPos
ShowWindow
IsWindowVisible
SetTimer
PostMessageW
IsWindow
CreateWindowExW
GetWindowRect
GetWindowLongW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
DispatchMessageW
wvsprintfW
SetCapture
MonitorFromPoint
GetClientRect
GetKeyboardLayoutList
WindowFromPoint
SystemParametersInfoW
GetSystemMetrics
BeginPaint
FindWindowW
SubtractRect
IsWindowEnabled
KillTimer
ActivateKeyboardLayout
GetKeyState
SetForegroundWindow
UnionRect
EndPaint
UpdateLayeredWindow
LoadCursorW
GetWindowThreadProcessId

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msimg32

TransparentBlt
AlphaBlend

psapi

GetModuleFileNameExW

gdi32

GetFontData
CreatePen
CreateCompatibleBitmap
CreateCompatibleDC
SelectClipRgn
SetBkMode
CreateFontIndirectW
CreateDIBSection
StretchDIBits
DeleteDC
BitBlt
GetDeviceCaps
StretchBlt
DeleteObject
SelectObject
GetObjectW
CreateSolidBrush

advapi32

SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
GetSidLengthRequired
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
LookupAccountSidW
RegOpenKeyW
RegCloseKey
RegOpenKeyExW
GetTokenInformation
RegEnumValueW
OpenProcessToken
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
BuildExplicitAccessWithNameW

shell32

SHGetFolderPathW
SHFileOperationW

ole32

CoCreateInstance
CreateStreamOnHGlobal
OleSetContainedObject
OleCreate
OleDraw
CoTaskMemAlloc
CoInitialize

oleaut32

SysFreeString
GetErrorInfo
SysAllocString

urlmon

CreateURLMoniker

Sections

.text
Size: 725KB - Virtual size: 724KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4bbc99181e3a8a6bd6382222e896099b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

version

msimg32

psapi

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

Sections

.text Size: 725KB - Virtual size: 724KB

.rdata Size: 189KB - Virtual size: 188KB

.data Size: 24KB - Virtual size: 46KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 48KB - Virtual size: 48KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 725KB - Virtual size: 724KB

.rdata
Size: 189KB - Virtual size: 188KB

.data
Size: 24KB - Virtual size: 46KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 48KB - Virtual size: 48KB

UPX0
Size: 144KB - Virtual size: 380KB