48cbba7a5dcfd2af450ce23f09db75cc62b2ddfb9e54f9058b7ae98eca5b33af

Sharing

Copy URL Twitter E-mail

General

Target

48cbba7a5dcfd2af450ce23f09db75cc62b2ddfb9e54f9058b7ae98eca5b33af
Size

171KB
MD5

815cc18dba18d29e4c8b7b47e4cdc7c6
SHA1

ae7102f121ea6c3eba79b8ea612a79686fce19d4
SHA256

48cbba7a5dcfd2af450ce23f09db75cc62b2ddfb9e54f9058b7ae98eca5b33af
SHA512

86aa1f968d38fcd9a4506829cb45fba1028dc1fa8c72982cf8f73bc4b10f6baba007d35f84a36fe6c57ce68a223ff38e6120ba4cafdc161ffa53f694a741f5b2
SSDEEP

3072:e9F4zkkZRMmmV5iFwBVUi2IAFn4FJLwF/aMZoZXce/U+xxYUUppEqh/:6KmZ4FwB/hAFn2wd+RNxY3Z/

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

48cbba7a5dcfd2af450ce23f09db75cc62b2ddfb9e54f9058b7ae98eca5b33af
.exe windows x86

6ebe76a54d300101ed4355a3eed24c1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetSecurityInfo
GetAce
GetSecurityInfo
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue

kernel32

lstrlenW
ExpandEnvironmentStringsW
GetLastError
LocalAlloc
SetEvent
LocalReAlloc
SetLastError
FindClose
FindNextFileW
CompareStringW
lstrcmpiW
FindFirstFileW
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
GetEnvironmentVariableW
FindCloseChangeNotification
CloseHandle
Sleep
WaitForMultipleObjects
FindNextChangeNotification
CreateEventW
FindFirstChangeNotificationW
ResumeThread
SetThreadPriority
CreateThread
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
SetProcessShutdownParameters
OpenEventW
HeapSetInformation
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
LocalFree
ExitThread
UnhandledExceptionFilter

user32

DestroyIcon
KillTimer
SetTimer
LoadImageW
DialogBoxParamW
DefWindowProcW
LoadIconW
PostQuitMessage
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
SetDlgItemTextW
MessageBoxW
LoadStringW
SetWindowPos
GetDesktopWindow
GetParent
GetSystemMetrics
GetWindowLongW
GetWindowRect
SetForegroundWindow
CheckDlgButton
SendMessageW
PostMessageW
GetClientRect
GetDlgItem
SendDlgItemMessageW
IsDlgButtonChecked
RegisterClassW
EndDialog

msvcrt

_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_vsnwprintf
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs

shell32

SHGetFileInfoW
ord60
Shell_NotifyIconW

comctl32

ord17

ole32

CoInitialize

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6ebe76a54d300101ed4355a3eed24c1d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

comctl32

ole32

Sections

.text Size: 17KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 2KB - Virtual size: 1KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 17KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 2KB - Virtual size: 1KB

UPX0
Size: 144KB - Virtual size: 380KB