b7ad70bb3f586cd34a057a4b3cb6e40d5dc6376ac34db8ff24d8272f80128175

Sharing

Copy URL Twitter E-mail

General

Target

b7ad70bb3f586cd34a057a4b3cb6e40d5dc6376ac34db8ff24d8272f80128175
Size

876KB
MD5

6380b9412eda3eecfa3001cd5442fb8f
SHA1

a759629047c7df0c9a593c31d3d3b83c573e25ba
SHA256

b7ad70bb3f586cd34a057a4b3cb6e40d5dc6376ac34db8ff24d8272f80128175
SHA512

ff43f464fea15d24dcce19a46a7b590e46ef83390a6746b2cdcf768367ddc496680ccf583ebae3d12479183584e252e2ef4660367fc8462d58f38adc3412941d
SSDEEP

12288:/YFC4SWtGClb6CLJaCFL0JA6naO/ZSWovQ6EHhmscCPRXQeTG6t5HocS/X6pdBAP:HRW+hSkXLTG6tzSOBAsk7VvC

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

b7ad70bb3f586cd34a057a4b3cb6e40d5dc6376ac34db8ff24d8272f80128175
.exe windows x86

1fe125899eb4d757f2610e6629b757ed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_ReplaceIcon
ord6
ord17
ImageList_Create
CreateToolbarEx

winmm

timeSetEvent
PlaySoundA
timeGetTime
timeKillEvent

kernel32

MoveFileA
CreateDirectoryA
GetVersionExA
MulDiv
GetStdHandle
AllocConsole
WriteConsoleA
OutputDebugStringA
GetComputerNameA
SearchPathA
GlobalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreA
SetThreadPriority
TlsSetValue
GetCurrentThreadId
DuplicateHandle
GetCurrentThread
GetCurrentProcess
TlsAlloc
TlsGetValue
GetSystemTime
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
ReadFile
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentDirectoryA
InterlockedIncrement
InterlockedDecrement
HeapSize
SetHandleCount
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
FatalAppExitA
SetLastError
TlsFree
ExitThread
GetVersion
GetCommandLineA
GetStartupInfoA
TerminateProcess
ExitProcess
GetFullPathNameA
GetFileAttributesA
HeapAlloc
GetFileType
SetStdHandle
GetLocalTime
GetTimeZoneInformation
HeapFree
RaiseException
RtlUnwind
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileTime
SetEndOfFile
FlushFileBuffers
SystemTimeToFileTime
SetFileTime
SetFilePointer
WriteFile
CreateFileA
GetLogicalDriveStringsA
GetDriveTypeA
lstrlenA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetErrorMode
CopyFileA
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteFileA
GetModuleFileNameA
FindFirstFileA
FindNextFileA
FindClose
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
GlobalAlloc
GlobalLock
GlobalUnlock
GetLastError
FormatMessageA
GetSystemTimeAsFileTime
LocalFree
Beep
Sleep
SetEvent
CloseHandle
WaitForSingleObject
CreateThread
ResumeThread
CreateEventA
GetModuleHandleA
GetUserDefaultLCID
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
GetLocaleInfoW
GetCPInfo

user32

SetWindowsHookExA
GetWindowThreadProcessId
UnhookWindowsHookEx
CallNextHookEx
GetScrollInfo
IsDlgButtonChecked
GetMessageA
LoadKeyboardLayoutA
LoadBitmapA
GetMenuStringA
ModifyMenuA
PtInRect
GetDesktopWindow
SetWindowRgn
OpenDesktopA
EnumDesktopWindows
CloseDesktop
FindWindowA
GetClassNameA
DestroyIcon
EnableWindow
GetWindowTextA
GetMenuItemCount
RemoveMenu
SendDlgItemMessageA
PeekMessageA
TranslateMessage
DispatchMessageA
DestroyMenu
GetKeyboardState
GetMenuItemID
SetMenuDefaultItem
TrackPopupMenu
LoadStringA
RegisterClassExA
LoadMenuA
GetCursorPos
SetCursorPos
GetSystemMetrics
RedrawWindow
EmptyClipboard
SetClipboardData
GetClipboardOwner
OpenClipboard
GetClipboardData
LoadImageA
IsRectEmpty
DialogBoxParamA
SetDlgItemTextA
CloseClipboard
BeginPaint
EndPaint
GetForegroundWindow
GetWindow
GetFocus
SetCursor
IsWindow
DefWindowProcA
ChangeClipboardChain
ShowScrollBar
ToAscii
GetKeyState
GetSubMenu
FillRect
SetForegroundWindow
EndDialog
CreateAcceleratorTableA
TranslateAcceleratorA
DestroyAcceleratorTable
SetWindowLongA
GetParent
GetDlgItemTextA
GetWindowLongA
RegisterWindowMessageA
ShowWindow
CreateWindowExA
SendMessageA
GetClientRect
ReleaseDC
GetDC
RegisterClassA
LoadCursorA
LoadIconA
PostQuitMessage
GetDlgItemInt
SetFocus
KillTimer
GetWindowRect
GetDlgItem
SetTimer
EnableMenuItem
wsprintfA
IsIconic
InvalidateRgn
PostMessageA
GetKeyboardLayoutNameA
SetScrollInfo
ScrollWindowEx
DestroyWindow
DrawTextA
InvalidateRect
SystemParametersInfoA
SetRect
AdjustWindowRectEx
SetWindowPos
MoveWindow
SetWindowTextA
UpdateWindow
SetDlgItemInt
MessageBoxA
GetSystemMenu
AppendMenuA
DrawMenuBar
CheckMenuItem
SetClipboardViewer

gdi32

CreateCompatibleBitmap
ExtTextOutA
RealizePalette
SelectPalette
SetDIBColorTable
CreateDIBSection
CombineRgn
CreateRectRgn
GetStockObject
SetBkColor
StretchBlt
SetBrushOrgEx
SetStretchBltMode
SetPixelV
CreateRectRgnIndirect
CreateFontIndirectA
GdiFlush
SetBkMode
Rectangle
CreateFontA
CreatePolygonRgn
LineTo
MoveToEx
CreatePen
SetTextColor
GetDeviceCaps
CreatePalette
GetClipBox
CreateCompatibleDC
CreateSolidBrush
SelectObject
PatBlt
BitBlt
DeleteObject
UpdateColors
DeleteDC

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

advapi32

RegQueryValueExA
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyA
RegSetValueA
RegQueryInfoKeyA
RegEnumValueA
RegCloseKey

shell32

SHGetPathFromIDListA
Shell_NotifyIconA
SHGetSpecialFolderLocation

wsock32

recv
bind
listen
WSAAsyncSelect
send
shutdown
closesocket
inet_ntoa
ioctlsocket
gethostbyname
htons
connect
getpeername
select
WSAGetLastError
accept
WSACleanup
WSAStartup
socket
setsockopt

Sections

.text
Size: 436KB - Virtual size: 435KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1fe125899eb4d757f2610e6629b757ed

Headers

File Characteristics

Imports

comctl32

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

wsock32

Sections

.text Size: 436KB - Virtual size: 435KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 48KB - Virtual size: 73KB

.idata Size: 12KB - Virtual size: 10KB

.rsrc Size: 176KB - Virtual size: 172KB

.reloc Size: 20KB - Virtual size: 18KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 436KB - Virtual size: 435KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 48KB - Virtual size: 73KB

.idata
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 176KB - Virtual size: 172KB

.reloc
Size: 20KB - Virtual size: 18KB

UPX0
Size: 144KB - Virtual size: 380KB