9b2d3fd2681427a06760e5a147816a43ddbc5c19abb14aa86038f70e78d88953

Sharing

Copy URL Twitter E-mail

General

Target

9b2d3fd2681427a06760e5a147816a43ddbc5c19abb14aa86038f70e78d88953
Size

260KB
MD5

78fa61ecc18c538e665a5c399f0b0eb0
SHA1

454111b44d6ec6837aa500ba9cb8f6f362838550
SHA256

9b2d3fd2681427a06760e5a147816a43ddbc5c19abb14aa86038f70e78d88953
SHA512

93c9a884e4df303d67b12e7e508909e1285033388829b74f3625d0d41f994539735aacdc52c8b75b67e5e5862d7a24e63b190094d3d725ff729ce22d2a119e40
SSDEEP

6144:kJtJT49aYsxbbQtXiAHrKLNk3IxMLiL0ZFzobKgqHe:kJtJT49/sxbmNck3IxX0ZFzYKgq+

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

9b2d3fd2681427a06760e5a147816a43ddbc5c19abb14aa86038f70e78d88953
.exe windows x86

168c5c99cec1a4fc2d018cffb200a83f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

SHDeleteKeyW
SHCopyKeyW

kernel32

GetModuleHandleW
lstrcpynW
ReadFile
SetFilePointer
CreateFileW
WriteFile
SearchPathW
MoveFileExW
GetFileSize
FindNextFileW
GetWindowsDirectoryW
GetLocalTime
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetUserDefaultLangID
LCMapStringW
LCMapStringA
SetStdHandle
FlushFileBuffers
LoadLibraryA
lstrcmpW
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
RtlUnwind
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
CreateProcessW
GetExitCodeProcess
CloseHandle
LocalAlloc
LocalFree
GetSystemDirectoryW
GetVersionExW
GetCurrentDirectoryW
lstrcpyW
lstrcatW
GetCommandLineW
lstrlenW
GetProcAddress
LoadLibraryW
Sleep
FreeLibrary
GetCurrentProcess
DeleteFileW
WideCharToMultiByte
FormatMessageW
GetEnvironmentVariableW
lstrcmpiW
CopyFileW
FindFirstFileW
FindClose
GetOEMCP
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
VirtualAlloc
HeapReAlloc

user32

IntersectRect
CreateDialogParamW
SetWindowPos
EnumDisplaySettingsW
ChangeDisplaySettingsW
EnumDisplaySettingsExW
GetDlgItem
SetWindowTextW
KillTimer
EndDialog
SetTimer
DialogBoxParamW
GetDC
SystemParametersInfoW
ReleaseDC
InvalidateRect
GetSystemMetrics
ExitWindowsEx
DestroyWindow
PostQuitMessage
DefWindowProcW
wsprintfW
MessageBoxW
FindWindowW
SendMessageW
EnumDisplayDevicesW
LoadCursorW
RegisterClassW
CreateWindowExW
ShowWindow
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
BlockInput

gdi32

ExtEscape
CreateFontIndirectW
SelectObject
SetTextColor
SetBkMode
DeleteObject
DeleteDC
CreateDCW
TextOutW

advapi32

RegEnumKeyA
RegEnumKeyW
RegDeleteKeyW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSaveKeyW
RegRestoreKeyW
RegQueryValueExW
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA

Sections

.text
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

168c5c99cec1a4fc2d018cffb200a83f

Headers

File Characteristics

Imports

version

shlwapi

kernel32

user32

gdi32

advapi32

Sections

.text Size: 84KB - Virtual size: 82KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 28KB - Virtual size: 67KB

.rsrc Size: 28KB - Virtual size: 25KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 84KB - Virtual size: 82KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 28KB - Virtual size: 67KB

.rsrc
Size: 28KB - Virtual size: 25KB

.UPX0
Size: 108KB - Virtual size: 260KB