4acf95d0a9d11b02f34ab2199415dbbf290b903a3fb99bcb3b8d6dc304a71d4a

Sharing

Copy URL Twitter E-mail

General

Target

4acf95d0a9d11b02f34ab2199415dbbf290b903a3fb99bcb3b8d6dc304a71d4a
Size

160KB
MD5

7700005c40161fa6020010b985217d02
SHA1

8fba40912adeb438d9f131ab54484b6894320d34
SHA256

4acf95d0a9d11b02f34ab2199415dbbf290b903a3fb99bcb3b8d6dc304a71d4a
SHA512

40668d7bf7d87ab7d6fcb160f8bd8cf09e8f348b910bdb714461844c18f266573268f18ac96d703d296e39b09528b60b204f35de05df37979501cf67945de891
SSDEEP

3072:ncywTj5CsXA8bbExybozoP6X7ZNtQHGSQGr5wy5TJ:n3gNCMb6y8ZX7ZPZSQGt7TJ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

4acf95d0a9d11b02f34ab2199415dbbf290b903a3fb99bcb3b8d6dc304a71d4a
.exe windows x86

2227e3635a973ccd139378e3aa565804

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetGetConnectionA

kernel32

GetWindowsDirectoryA
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA
GetProcAddress
GetLastError
LoadLibraryA
SetLastError
GetCommandLineA
CreateProcessA
GetCurrentDirectoryA
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
Sleep
GlobalMemoryStatus
GetVersionExA
GetSystemDefaultLangID
GetStartupInfoA
GetModuleHandleA
SetEnvironmentVariableA
GetDriveTypeA
GetTempPathA
GetComputerNameA

user32

ReleaseDC
GetDC
GetSystemMetrics
MessageBoxA

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

msvcrt

_errno
isspace
fgets
strcat
free
sprintf
strchr
strstr
malloc
_controlfp
rename
localtime
time
strcpy
fclose
fprintf
fopen
_stat
strlen
_stricmp
strcmp
_strnicmp
memcpy
strrchr
_splitpath
strncat
_except_handler3
islower
_exit
memset
sscanf
fseek
fwrite
_fsopen
_makepath
??3@YAXPAX@Z
__CxxFrameHandler
strncmp
_initterm
__getmainargs
_XcptFilter
exit
_acmdln
__p__fmode
__set_app_type
__setusermatherr
_adjust_fdiv
__p__commode

Exports

Exports

ArchiveFile
BH_GetBHSystemInfo
ConfigCloseKey
ConfigCreateFile
ConfigDelete
ConfigGet
ConfigGetBOOL
ConfigGetKey
ConfigGetMacro
ConfigGetSettings
ConfigOpenKey
ConfigPut
ConfigSetMacro
ConvertFromUNC
ConvertToUNC
FreeLangList
GetApplicationId
GetLangDesc
GetOSLangId
InitLangDesc
NormalizePathUnix
NormalizePathWin
SetBHInitConfigEx
SetLangDesc
SubstituteMacros

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2227e3635a973ccd139378e3aa565804

Headers

File Characteristics

Imports

mpr

kernel32

user32

gdi32

advapi32

shell32

msvcrt

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 49KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 49KB

.UPX0
Size: 104KB - Virtual size: 252KB