d40c343d5e1ab4f35e5d06fe1f9ecc7c8dc225181562ae7b1758680e9de4ce69

Sharing

Copy URL Twitter E-mail

General

Target

d40c343d5e1ab4f35e5d06fe1f9ecc7c8dc225181562ae7b1758680e9de4ce69
Size

732KB
MD5

6d366b631fdc335fd1ef56efedcb6454
SHA1

6b1765f9b0a17d15c6c46a6726394756148f6d55
SHA256

d40c343d5e1ab4f35e5d06fe1f9ecc7c8dc225181562ae7b1758680e9de4ce69
SHA512

48c2f91507d398cc6b86a5e76f0a3fea305564b44a8d9e6204839e7b7ac672ebe9562f49ca265065fd26dbe433af7e3fd7eaa3a9289f44c60558bfdedf41f34f
SSDEEP

12288:8Ys6UCyp3c3atkau/H2BFpT0xGoBuLdVaDo6J1D3rGcXbtoA6taTtsNIQRLB:8bC2c3atkhH4PTZLJQDl1D3rGcXpi8ub

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

d40c343d5e1ab4f35e5d06fe1f9ecc7c8dc225181562ae7b1758680e9de4ce69
.exe windows x86

a0fcbf5acee959124d6559857382bbb2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForMultipleObjects
GetVersionExA
FindNextFileA
FindClose
GetTempFileNameA
GetVolumeInformationA
GetFileAttributesA
GetFileInformationByHandle
CreateFileA
FindFirstFileA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetProcessTimes
GetCurrentProcess
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileAttributesA
SetFileTime
GetFileTime
GetSystemTimeAsFileTime
GetComputerNameA
GetTickCount
GetExitCodeProcess
GetExitCodeThread
FormatMessageA
LocalFree
LocalAlloc
CreateFileW
GetFullPathNameW
GetProcAddress
GetModuleHandleA
FreeEnvironmentStringsA
GetEnvironmentStrings
TlsAlloc
GetDriveTypeA
FreeLibrary
WideCharToMultiByte
LoadLibraryA
GetShortPathNameA
GetFullPathNameA
Sleep
CopyFileA
DeleteCriticalSection
GetStdHandle
SetConsoleCtrlHandler
GetModuleFileNameA
GenerateConsoleCtrlEvent
TerminateProcess
OpenProcess
TerminateThread
LockFileEx
UnlockFileEx
MultiByteToWideChar
DeleteFileA
MoveFileExA
SetEndOfFile
CreateProcessA
GetTempPathA
SetStdHandle
TlsSetValue
TlsGetValue
ReadFile
WriteFile
SetFilePointer
DuplicateHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetCurrentDirectoryA
SetLastError

user32

MsgWaitForMultipleObjects
KillTimer
PostThreadMessageA
TranslateMessage
SetTimer
PeekMessageA
DispatchMessageA

advapi32

RegQueryValueExA
RegOpenKeyExA
GetUserNameA
LookupAccountNameA
RegCloseKey

ws2_32

WSCEnumProtocols
closesocket
shutdown
setsockopt
sendto
send
select
__WSAFDIsSet
recvfrom
recv
listen
ioctlsocket
WSASocketA
getsockname
getpeername
connect
bind
accept
ntohs
ntohl
htons
htonl
WSAStartup
WSAGetLastError
gethostbyaddr
gethostbyname
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockopt

msvcrt

__p__commode
_adjust_fdiv
__set_app_type
_except_handler3
_controlfp
__p__fmode
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_close
_execvp
_fdopen
_spawnv
_execv
_chmod
_access
_chdir
_rmdir
_mkdir
_write
_read
_dup2
_dup
_setmode
_fileno
_stricmp
_utime
_unlink
_open
_isatty
_umask
_strupr
_fstati64
fclose
wcstombs
_fmode
memcpy
memmove
strcmp
strchr
atoi
strcat
strlen
memset
memcmp
strncmp
strcpy
localeconv
setlocale
toupper
islower
tolower
isupper
strxfrm
exit
qsort
strrchr
longjmp
_setjmp3
time
pow
fmod
floor
_isnan
atan2
sin
cos
rand
srand
exp
log
sqrt
ceil
isspace
sprintf
modf
isalpha
gmtime
localtime
ispunct
isprint
isgraph
iscntrl
isdigit
isalnum
memchr
frexp
strtoul
vsprintf
_errno
_stati64
strncpy
clock
__pioinfo
_open_osfhandle
__doserrno
__p__environ
_iob
strerror
_sys_nerr
fread
fwrite
freopen
ungetc
clearerr
fflush
fgetpos
fsetpos
_telli64
fseek
abort
_pipe
_lseeki64
getenv
setvbuf
fgetc
malloc
realloc
free
_get_osfhandle
_control87
signal
_getpid
fopen
wcscpy
rename

Exports

Exports

PerlIO_byte
PerlIO_crlf
PerlIO_pending
PerlIO_perlio
PerlIO_raw
PerlIO_stdio
PerlIO_unix
PerlIO_utf8
PerlIO_win32

Sections

.text
Size: 536KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a0fcbf5acee959124d6559857382bbb2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

msvcrt

Exports

Exports

Sections

.text Size: 536KB - Virtual size: 532KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 80KB - Virtual size: 88KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 536KB - Virtual size: 532KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 80KB - Virtual size: 88KB

.UPX0
Size: 104KB - Virtual size: 252KB