33ea1bc77427bfd6f48dfa8fabe86a4d076d6fd9b3b529625c0d4fe99e73f702

General

Target

33ea1bc77427bfd6f48dfa8fabe86a4d076d6fd9b3b529625c0d4fe99e73f702
Size

121KB
MD5

71118f6ecf1fe89115f7af809c17937a
SHA1

3080d3ece0d6a0705615f9deaa6f544ae5846194
SHA256

33ea1bc77427bfd6f48dfa8fabe86a4d076d6fd9b3b529625c0d4fe99e73f702
SHA512

e7b821997812b83d9738fe5fab456e4e8b5a1446b0c6dc0b8545e91dfae317b97fe307db2f037554b6df87222a4c755845432c5b96a59f4798cdce8c6866ea16
SSDEEP

3072:GdLwrklH8RtUwRGz/E1MOYJchvOvHw22RW/aFNF:GdLwwH8RiwRGj0FmvHyCaFNF

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

33ea1bc77427bfd6f48dfa8fabe86a4d076d6fd9b3b529625c0d4fe99e73f702
.exe windows x86

bf76e912fcff70705e01457a652af976

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

kernel32

CloseHandle
GetLastError
CreateEventW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
_cexit
__set_app_type
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__p__fmode
memset
__CxxFrameHandler3
swprintf_s
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
__getmainargs
malloc
_callnewh
_CxxThrowException
free
??0exception@@QAE@ABV0@@Z

ole32

CoSetProxyBlanket
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoInitialize
CLSIDFromString

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf76e912fcff70705e01457a652af976

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 964B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 724B

.UPX0 Size: 108KB - Virtual size: 256KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 964B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 724B

.UPX0
Size: 108KB - Virtual size: 256KB