56f73a3dc3212cf45f32b1278450feb3d58d148ee6efb33afb40df9727e0b1a8

Sharing

Copy URL Twitter E-mail

General

Target

56f73a3dc3212cf45f32b1278450feb3d58d148ee6efb33afb40df9727e0b1a8
Size

267KB
MD5

7ccc5e30ae0d1e3c85e0f7a516b71539
SHA1

8864ff417090cbfa08c0b37ce0941fd44f60d75f
SHA256

56f73a3dc3212cf45f32b1278450feb3d58d148ee6efb33afb40df9727e0b1a8
SHA512

bc98ba23e373e91c959f6d238da50ade74bffcd30c2b603d380ff1b5e93c2ba7d80a7b670d29e9a4b8ab092c1eb1bf2268b96860308258814eb9949b2ebfe874
SSDEEP

3072:8Tjc+z2sMIq9oZyqdf2qX2b1sc8gGAWNZ2vcJnumE0iTE4qkR3wKSr7T2xwHoY22:Aq9ZqX2HHj3b0X3mB8T2x6f2wooGU

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

56f73a3dc3212cf45f32b1278450feb3d58d148ee6efb33afb40df9727e0b1a8
.exe windows x86

471d5f3fa7f55ca22681b55430a0e2c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegisterServiceCtrlHandlerExW
RegCloseKey
RegOpenKeyExW
RegDisablePredefinedCache
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetServiceStatus
StartServiceCtrlDispatcherW
SetThreadToken
OpenThreadToken
OpenProcessToken

kernel32

ExitProcess
Sleep
OpenEventW
GetLastError
HeapSetInformation
GetProcessHeap
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
SetEvent
SetLastError
OpenProcess
InterlockedIncrement
RaiseException
InterlockedDecrement
GetModuleHandleW
TlsSetValue
LoadLibraryA
LocalAlloc
GetCurrentThread
GetProcAddress
FreeLibrary
DeleteCriticalSection
HeapFree
HeapAlloc
SetThreadpoolTimer
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitThread
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
CloseHandle
WaitForSingleObject
CreateEventW
CreateThread
GetModuleHandleA

msvcrt

_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
??3@YAXPAX@Z
_purecall
_stricmp
memset
__setusermatherr
_adjust_fdiv
__set_app_type
__p__commode
wcschr
memcpy
_except_handler4_common
?terminate@@YAXXZ
_controlfp
??2@YAPAXI@Z
_wcsicmp
__p__fmode

rpcrt4

RpcSsContextLockExclusive
NdrAsyncServerCall
RpcAsyncCompleteCall
RpcImpersonateClient
RpcRevertToSelf
I_RpcBindingIsClientLocal
I_RpcSessionStrictContextHandle
RpcRaiseException
NdrServerCall2
RpcMgmtSetServerStackSize
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerUseProtseqEpA
RpcServerUseProtseqW
RpcObjectSetType
RpcServerRegisterIf2
RpcServerRegisterIf
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcStringFreeW
NdrAsyncClientCall
NdrClientCall2
RpcServerTestCancel
RpcAsyncAbortCall
I_RpcExceptionFilter
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
I_RpcBindingInqTransportType
RpcRevertToSelfEx

ntdll

TpWaitForWait
TpSetWait
TpReleaseTimer
TpWaitForTimer
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpCallbackMayRunLong
RtlNtStatusToDosError
TpStartAsyncIoOperation
TpAllocIoCompletion
TpAllocAlpcCompletion
TpSetPoolMinThreads
TpSetPoolMaxThreads
TpAllocPool
TpAllocWait
TpSimpleTryPost
TpPostWork
TpAllocWork
TpSetTimer
TpAllocTimer
TpReleasePool
TpReleaseWait
TpWaitForWork
RtlValidRelativeSecurityDescriptor
TpReleaseWork

slc

SLGetWindowsInformationDWORD

Exports

Exports

ServerGetPrintClassObject
ServerGetTlsBindingHandle
YAbortPrinter
YAddJob
YDriverUnloadComplete
YEndDocPrinter
YEndPagePrinter
YFlushPrinter
YGetPrinter
YGetPrinterDriver2
YGetPrinterDriverDirectory
YReadPrinter
YSeekPrinter
YSetJob
YSetPort
YSetPrinter
YSplReadPrinter
YStartDocPrinter
YStartPagePrinter
YWritePrinter

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

471d5f3fa7f55ca22681b55430a0e2c2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

rpcrt4

ntdll

slc

Exports

Exports

Sections

.text Size: 106KB - Virtual size: 105KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 5KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 106KB - Virtual size: 105KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 5KB

UPX0
Size: 144KB - Virtual size: 380KB