77abcdd5eb157bbfff560e33cb16b1269afdc0e96cc3d436a18cd0bb549b5d29

Sharing

Copy URL Twitter E-mail

General

Target

77abcdd5eb157bbfff560e33cb16b1269afdc0e96cc3d436a18cd0bb549b5d29
Size

876KB
MD5

404429c29bb14b063e1db0d6445397e0
SHA1

d3e5d77f4869fbca6a9c9189a1d428d3f4d2fd8d
SHA256

77abcdd5eb157bbfff560e33cb16b1269afdc0e96cc3d436a18cd0bb549b5d29
SHA512

e81bebf1959814bdc20abd3ec33f715b5841f003dcd6b8738872c578328d39dc413f7f3fc8f023b9398dccbfaf7ddbd93e78bd9d17536e952e573ae042ecf230
SSDEEP

12288:Ymm9UpwQsmJQvz/FIAwLxdS6LwuCYVkiOIDIGf+bxu0UdYK5/7+XST5l:bS6rCYOiF8Gf+LeYK5aXO5

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

77abcdd5eb157bbfff560e33cb16b1269afdc0e96cc3d436a18cd0bb549b5d29
.exe windows x86

6beedd5e90501443aa68d2a02269c506

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tinyxml

?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
??0TiXmlDocument@@QAE@XZ
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
??1TiXmlDocument@@UAE@XZ
?ErrorDesc@TiXmlDocument@@QBEPBDXZ
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
?GetText@TiXmlElement@@QBEPBDXZ

ws2_32

htonl
htons

common

??0CTXBSTR@@QAE@PB_W@Z
??1CTXStringW@@QAE@XZ
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??0CTXStringW@@QAE@PB_W@Z
?RecordTransBegin@Perf@Util@@YA_JPB_WHH00@Z
??BCTXStringW@@QBEPB_WXZ
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXStringW@@QAE@XZ
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?NotifyIdle@TXTimer@@YAXXZ
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??0CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??ICTXBSTR@@QAEPAPA_WXZ
?IsEmpty@CTXBSTR@@QAEHXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
??1CTXBSTR@@QAE@XZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
??0CTXStringW@@QAE@PA_W@Z
?Replace@CTXStringW@@QAEHPB_W0@Z
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
?TXAssert@@YAXPB_W0H@Z
?ValidateBugReport@TXBugReport@@YAXXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?GetLength@CTXStringW@@QBEHXZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??0CTXStringW@@QAE@ABV0@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?Record@Perf@Util@@YAJPB_WHH00@Z
?GetPlatformTpc@CoreCenter@Util@@YAHPAPAUITXDataRead@@@Z
?GetPlatformCore@CoreCenter@Util@@YAHPAPAUITXPlatformCore@@@Z
??8CTXBSTR@@QBE_NPB_W@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
?GetLocalePath@TXI18N@@YA?AVCTXStringW@@PB_W@Z
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?Find@CTXStringW@@QBEHPB_WH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?OnUninitCom@Misc@Util@@YAXXZ
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?SplitQNC@FS@@YAHPB_WAAVCTXStringW@@1@Z
?GetFileName@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetParentDir@File@Util@@YA?AVCTXStringW@@ABV3@@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??M@YA_NABVCTXStringW@@0@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ

gf

?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z

kernel32

VirtualQuery
ReleaseMutex
OpenProcess
lstrcmpiW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
Sleep
OpenEventW
OpenFileMappingW
GetTickCount
GetSystemDefaultLangID
FreeLibrary
LoadLibraryA
InterlockedCompareExchange
SwitchToThread
GetLocalTime
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SetFilePointer
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
SetEvent
CreateEventW
WaitForSingleObject
SetDllDirectoryW
LoadLibraryW
GetCommandLineW
LocalFree
DeleteFileW
ExpandEnvironmentStringsW
GetCurrentProcess
GetVersionExW
GetModuleHandleW
GetProcAddress
GetSystemInfo
CreateProcessW
GetSystemDirectoryW
RaiseException
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenW
lstrcpynW
CreateDirectoryW
CreateFileW
CloseHandle
GetFileAttributesW
GetModuleFileNameW
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetProcessHeap
SetLastError
InterlockedExchange
GetSystemTimeAsFileTime
IsDebuggerPresent

user32

RegisterWindowMessageW
IsWindow
PostMessageW
SetWindowLongW
UnregisterClassA
SendMessageW
LoadStringW
GetWindowLongW
SendMessageTimeoutW
IsWindowEnabled
EnumThreadWindows
GetClassLongW
IsWindowVisible
GetClassNameW
DispatchMessageW
TranslateMessage
PeekMessageW
GetMessageW
WaitMessage
ScreenToClient
GetWindowRect
PostThreadMessageW
FindWindowA
MessageBoxW

advapi32

RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

shell32

CommandLineToArgvW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW

ole32

OleInitialize
OleUninitialize
CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString

atl80

ord58
ord31
ord32
ord30

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathUnquoteSpacesW

msvcp80

?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW

comctl32

InitCommonControlsEx

msvcr80

?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
_snwprintf
memset
wcschr
wcsrchr
wcsncpy
_wsplitpath
memmove_s
_wcsicmp
_vsnwprintf_s
memcpy
_purecall
free
atoi
atol
wcsncat
_wtoi
wcsstr
_wcsdup
_wtoi64
wcsncpy_s
malloc
_time64
_wtol
wcscat_s
_memicmp
setlocale
strchr
_vsnprintf
fflush
strncpy_s
_snprintf_s
fwrite
strrchr
swscanf_s
_wsplitpath_s
wcscpy_s
_recalloc
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
_invalid_parameter_noinfo
??3@YAXPAX@Z
_CIsqrt
_stricmp
_except_handler3
??0exception@std@@QAE@ABQBD@Z

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6beedd5e90501443aa68d2a02269c506

Headers

DLL Characteristics

File Characteristics

Imports

tinyxml

ws2_32

common

gf

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl80

shlwapi

msvcp80

psapi

comctl32

msvcr80

version

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 92KB - Virtual size: 90KB

.data Size: 20KB - Virtual size: 20KB

.rsrc Size: 292KB - Virtual size: 288KB

.reloc Size: 32KB - Virtual size: 29KB

.UPX Size: 240KB - Virtual size: 240KB

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 92KB - Virtual size: 90KB

.data
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 292KB - Virtual size: 288KB

.reloc
Size: 32KB - Virtual size: 29KB

.UPX
Size: 240KB - Virtual size: 240KB