314138214e07f1e580ad28a1f869092dc4a81d45000e79cd3f909ec46e93017b

Sharing

Copy URL Twitter E-mail

General

Target

314138214e07f1e580ad28a1f869092dc4a81d45000e79cd3f909ec46e93017b
Size

258KB
MD5

78edd7a0c1aecde6ac9a25410115e53b
SHA1

e816ccd58c08fd13e6d78af3dc70e5f5436b6291
SHA256

314138214e07f1e580ad28a1f869092dc4a81d45000e79cd3f909ec46e93017b
SHA512

48843dc69f6a4f8dd9eb6cee54ed6c27edff62852e4d96fec3f0e6504dc9ee629700db97669ac18bb0b78336d435ecdfd3e5b875b836271895f872c3d910c927
SSDEEP

6144:Pcc7+5+1kf15mJwFpqYzFDJ9Ugzc8hEzJ8:PcDj18JpGFtCt8hgq

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

314138214e07f1e580ad28a1f869092dc4a81d45000e79cd3f909ec46e93017b
.exe windows x86

2c3ea4f45ecc29a10d4a6b07d399cda8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueW
RegOpenKeyExW
RegCloseKey

kernel32

HeapSetInformation
ExpandEnvironmentStringsW
lstrlenW
GetModuleHandleW
GetStartupInfoW
GetCommandLineW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

user32

AllowSetForegroundWindow

msvcrt

_controlfp
_vsnwprintf
memset
__getmainargs
_cexit
_exit
_except_handler4_common
__p__commode
?terminate@@YAXXZ
__set_app_type
__p__fmode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoGetMalloc
CoTaskMemFree

shell32

ShellExecuteExW

shlwapi

ord158
ord437
StrTrimW

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 148KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c3ea4f45ecc29a10d4a6b07d399cda8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

shell32

shlwapi

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 888B

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 1024B - Virtual size: 872B

UPX0 Size: 148KB - Virtual size: 384KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 888B

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 1024B - Virtual size: 872B

UPX0
Size: 148KB - Virtual size: 384KB