0a04c64b7432f310ace5366a93f0a5485f634995dcd8951a4c0918f0bb9130a2

Sharing

Copy URL Twitter E-mail

General

Target

0a04c64b7432f310ace5366a93f0a5485f634995dcd8951a4c0918f0bb9130a2
Size

128KB
MD5

687afea3eab0d344dff98e5859d677fb
SHA1

d74dc4e8ca0475a6af7ccdf4b402e34500274578
SHA256

0a04c64b7432f310ace5366a93f0a5485f634995dcd8951a4c0918f0bb9130a2
SHA512

7509d3fdcc253a91e7dfa9e91b773a70c726f39f8e42f25a1db0e74002685103b794303f0fbe797feab83b53510962fcf48887d222f64f58714805dbffb4f75d
SSDEEP

1536:0xDSmIs/wt69b1DMzYfofc2DHY2iS4pN9WmCNWEAZpungOzp+edWTgLrpp:y9bOE2D42insNWqngwUY

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

0a04c64b7432f310ace5366a93f0a5485f634995dcd8951a4c0918f0bb9130a2
.exe windows x86

a7b115779c4f6b297a9e02a3a1af1a0d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

hid

HidP_GetScaledUsageValue
HidP_GetUsages
HidD_FreePreparsedData
HidP_MaxUsageListLength
HidP_GetSpecificValueCaps
HidP_GetSpecificButtonCaps
HidP_GetCaps
HidD_GetAttributes
HidD_GetPreparsedData
HidD_GetHidGuid
HidP_GetUsageValue

kernel32

ReleaseMutex
CreateThread
GetVersionExA
GetACP
CreateMutexA
OpenMutexA
GetCurrentThreadId
GetProcAddress
QueryPerformanceCounter
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
SetEvent
VirtualQuery
InterlockedExchange
RtlUnwind
GetCPInfo
GetOEMCP
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
GetSystemInfo
FreeLibrary
ExitThread
LocalAlloc
CreateFileA
CloseHandle
Sleep
CreateEventA
ReadFile
GetLastError
GetOverlappedResult
ResetEvent
GetStringTypeA
LoadLibraryA
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
VirtualProtect
GetTickCount
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ExitProcess
TerminateProcess
WriteFile
GetStdHandle
GetModuleFileNameA

user32

CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
GetSystemMetrics
BeginPaint
EndPaint
DestroyWindow
PostMessageA
DefWindowProcA
MessageBoxA
ShowCursor
SetWindowPos
EnumDisplaySettingsA
RegisterClassExA
LoadCursorA
PostQuitMessage

gdi32

GetStockObject
CreateFontA
GetTextMetricsA
CreatePen
DeleteObject
MoveToEx
LineTo
SetPixel
SelectObject
TextOutA
GetTextExtentPoint32A

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegLoadKeyA
RegUnLoadKeyA

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a7b115779c4f6b297a9e02a3a1af1a0d

Headers

File Characteristics

Imports

setupapi

hid

kernel32

user32

gdi32

advapi32

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 8KB - Virtual size: 5KB

.UPX Size: 60KB - Virtual size: 60KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 8KB - Virtual size: 5KB

.UPX
Size: 60KB - Virtual size: 60KB