4c40f213ffc43dd173ff457d09d1b12c8453c9f7fc966d241e2ab4d285011e55

General

Target

4c40f213ffc43dd173ff457d09d1b12c8453c9f7fc966d241e2ab4d285011e55
Size

185KB
MD5

4a1c65120a13fabd01f7375f2f3ab74d
SHA1

a1da54f059607964eec6455a9d80c30efb649436
SHA256

4c40f213ffc43dd173ff457d09d1b12c8453c9f7fc966d241e2ab4d285011e55
SHA512

8cfc0c3e70a78008477d883a9c3bfe0da689a212e1834a41e870b876e2421898598730a171c9c451dcf2abe33d916c307bdde348730c91df3d56164919a77abc
SSDEEP

3072:ph6Gfx/iPTdML0qEERF1wt83ZzpP6Gr/+9nvTXHFPGHf4YvW08Zjbh:CqxKPhML0qEGFB3DdavT3FaAIeh

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

4c40f213ffc43dd173ff457d09d1b12c8453c9f7fc966d241e2ab4d285011e55
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

NapalmBurn_UdfDirectoryCreate
NapalmBurn_UdfDirectoryDestroy
NapalmBurn_UdfDirectoryProcess
NapalmBurn_UdfDirectoryProcessEx
NapalmBurn_UdfDirectoryRootCreate
NapalmBurn_UdfDirectoryUnicodeCreate
NapalmBurn_UdfDirectoryUnicodeProcess
NapalmBurn_UdfDirectoryUnicodeProcessEx
NapalmBurn_UdfFileCreate
NapalmBurn_UdfFileDestroy
NapalmBurn_UdfFileDirectoryDateTimeGet
NapalmBurn_UdfFileDirectoryDateTimeSet
NapalmBurn_UdfFileMemoryCreate
NapalmBurn_UdfFileMemoryUnicodeCreate
NapalmBurn_UdfFileUnicodeCreate
NapalmBurn_UdfImpVolumeCreate
NapalmBurn_UdfImpVolumeDestroy
NapalmBurn_UdfImpVolumeList
NapalmBurn_UdfVolumeCreate
NapalmBurn_UdfVolumeDestroy
NapalmBurn_UdfVolumeSeekRead
NapalmBurn_UdfVolumeSizeInUCHARsGet
NapalmBurn_UdfVolumeStore
NapalmBurn_UdfVolumeUnicodeCreate
Napalm_CriticalSectionCreate
Napalm_CriticalSectionDestroy
Napalm_CriticalSectionEnter
Napalm_CriticalSectionLeave
Napalm_FileClose
Napalm_FileCreate
Napalm_FileDateTimeGet
Napalm_FileInitialize
Napalm_FileOpen
Napalm_FileReWind
Napalm_FileRead
Napalm_FileSizeInUCHARsGet
Napalm_FileUnicodeCreate
Napalm_FileUnicodeOpen
Napalm_FileWrite
Napalm_MemoryAllocate
Napalm_MemoryCopy
Napalm_MemoryFree
Napalm_MemoryZero
Napalm_StringCopy
Napalm_StringSizeInUCHARsGet
Napalm_StringUnicodeCopy
Napalm_StringUnicodeSizeInUSHORTsGet
Napalm_TraceGet
Napalm_TraceSet
Napalm_TraceText
Napalm_VersionGet

Sections

UPX0
Size: - Virtual size: 184KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 184KB

UPX1 Size: 43KB - Virtual size: 44KB

UPX2 Size: 25KB - Virtual size: 28KB

.text Size: 115KB - Virtual size: 116KB

Headers

File Characteristics

Sections

.text Size: 133KB - Virtual size: 133KB

.data Size: 4KB - Virtual size: 75KB

.reloc Size: 6KB - Virtual size: 6KB

UPX0
Size: - Virtual size: 184KB

UPX1
Size: 43KB - Virtual size: 44KB

UPX2
Size: 25KB - Virtual size: 28KB

.text
Size: 115KB - Virtual size: 116KB

.text
Size: 133KB - Virtual size: 133KB

.data
Size: 4KB - Virtual size: 75KB

.reloc
Size: 6KB - Virtual size: 6KB