9e23202bc956b90ab04c1f9f782739254ba38359ff3ea979b58494f0bd4b8d89

Sharing

Copy URL Twitter E-mail

General

Target

9e23202bc956b90ab04c1f9f782739254ba38359ff3ea979b58494f0bd4b8d89
Size

177KB
MD5

67f8fd6f3b817a2314be191af3edb595
SHA1

d4dc6442c9cf18b83efd437e5981fad3b673010e
SHA256

9e23202bc956b90ab04c1f9f782739254ba38359ff3ea979b58494f0bd4b8d89
SHA512

0ca6002e0e40594652b6f65ea1f8f71b90edc9e2ee0c8ace1061c3eb5e1fcc6ec5d3aa6945071cd519d788fa57103b6850fb229fe283f35465fc631d225ba68f
SSDEEP

3072:lPNeDsdV/OwHIGHDu/HIN3aA5jt/7urdMdrE+et6BWBsa2oZjmd5nkz40uE/5a8G:vNaK5/7EqEh66saLqn+B/+NraqaO

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

9e23202bc956b90ab04c1f9f782739254ba38359ff3ea979b58494f0bd4b8d89
.exe windows x86

940918d32a541b8717eb08b30e8dc0bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_exit
_c_exit
wcscat
wcsncpy
wcscpy
__CxxFrameHandler
exit
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
_XcptFilter
wcscmp
swprintf
wcsncat
_beginthreadex
_except_handler3
_snwprintf
_vsnwprintf
wprintf

advapi32

CheckTokenMembership
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
LookupAccountNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenServiceW
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
CreateWellKnownSid
SetServiceStatus
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
LogonUserW
ImpersonateLoggedOnUser
RevertToSelf
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken

kernel32

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFileTime
SystemTimeToFileTime
SetEvent
GetLastError
LocalFree
CloseHandle
LocalAlloc
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
SetCurrentDirectoryW
GetCurrentProcessId
GetFileTime
DeviceIoControl
CreateFileW
CreateDirectoryW
GetModuleFileNameW
SetFilePointer
WaitForSingleObjectEx
GetModuleHandleW
ResumeThread
HeapFree
GetProcessHeap
SetConsoleCtrlHandler
CreateMutexW
CreateEventW
GetCommandLineW
lstrcmpiW
GetCurrentThread
GetComputerNameExW
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTime
GetTimeFormatW
WideCharToMultiByte
WriteFile
OutputDebugStringW
GetDateFormatW
GetSystemTimeAsFileTime

user32

wsprintfW
LoadStringW

oleaut32

VariantInit
VariantClear

winsta

WinStationCloseServer
WinStationOpenServerW

rpcrt4

RpcServerListen
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcEpRegisterW
RpcServerInqBindings
RpcServerUseProtseqExW
RpcStringBindingParseW
RpcBindingFromStringBindingW
RpcServerUnregisterIf
RpcImpersonateClient
RpcBindingInqAuthClientW
RpcBindingServerFromClient
RpcEpResolveBinding
RpcMgmtInqServerPrincNameW
NdrClientCall2
NdrServerCall2
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcRevertToSelf
RpcStringBindingComposeW
RpcBindingSetAuthInfoW
RpcBindingFree
RpcBindingToStringBindingW
RpcStringFreeW

shell32

CommandLineToArgvW

esent

JetSetColumns
JetPrepareUpdate
JetGetColumnInfo
JetAttachDatabase
JetInit
JetUpdate
JetSetSystemParameter
JetSetColumn
JetCreateTableColumnIndex
JetCreateDatabase
JetDelete
JetMakeKey
JetSeek
JetRetrieveColumn
JetMove
JetCommitTransaction
JetCloseTable
JetCloseDatabase
JetEndSession
JetCreateIndex
JetRollback
JetOpenTable
JetOpenDatabase
JetBeginSession
JetTerm
JetIndexRecordCount
JetSetCurrentIndex
JetBeginTransaction

clusapi

ClusterEnum
GetNodeClusterState
OpenCluster
ClusterOpenEnum
ClusterGetEnumCount
CloseClusterResource
OpenClusterResource
ClusterResourceControl
ClusterCloseEnum
CloseCluster

resutils

ResUtilFindDependentDiskResourceDriveLetter
ResUtilFindSzProperty
ResUtilGetResourceDependency

netapi32

NetGetJoinInformation
NetApiBufferFree
NetApiBufferAllocate
DsGetDcNameW
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetLocalGroupGetMembers
NetLocalGroupAdd

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

940918d32a541b8717eb08b30e8dc0bc

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

user32

oleaut32

winsta

rpcrt4

shell32

esent

clusapi

resutils

netapi32

Sections

.text Size: 61KB - Virtual size: 60KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 7KB - Virtual size: 6KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 61KB - Virtual size: 60KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 7KB - Virtual size: 6KB

.UPX0
Size: 108KB - Virtual size: 260KB