41ed3db4eb3bcadbb8b4d24676823583dbd39d29f275c385d8280dd554e00694

Sharing

Copy URL Twitter E-mail

General

Target

41ed3db4eb3bcadbb8b4d24676823583dbd39d29f275c385d8280dd554e00694
Size

151KB
MD5

0e378d7d5b1c5dad77ed8cf159039b66
SHA1

68360fac4a42ae55797a68c945c7423955690f59
SHA256

41ed3db4eb3bcadbb8b4d24676823583dbd39d29f275c385d8280dd554e00694
SHA512

a0a9203c1821998a64f571fdb7029d7cd6a97e9b35458437cf47970810ef9ded948ca73a0a9983ae11873bdc2c01f306d0c79d0c754581b04186896d7b82e120
SSDEEP

3072:7r8q87ga6NLpMcez23pggCFg/E3JQA4nq4HxgphheGb35gPKjHr:7Y78Hez2ZZkg/E3JSBQeyqKjHr

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

41ed3db4eb3bcadbb8b4d24676823583dbd39d29f275c385d8280dd554e00694
.exe windows x86

2a32010b0683a00f1a1c6066c0a61901

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

kernel32

LocalFree
LocalAlloc
Sleep
SetThreadUILanguage
HeapSetInformation
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar

msvcrt

_write
_setmode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_cexit
__getmainargs
exit
atoi
memset
memmove
isprint
_vsnprintf
__p__commode
__p__fmode
_except_handler4_common
?terminate@@YAXXZ
_exit
__set_app_type
_controlfp

ntdll

RtlExtendedLargeIntegerDivide
NtClose
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlUpcaseUnicodeStringToOemString
RtlIpv4AddressToStringA
NtDeviceIoControlFile
NtWaitForSingleObject
RtlInitString
RtlAnsiStringToUnicodeString
NtCreateFile
RtlFreeUnicodeString
RtlGUIDFromString
RtlInitUnicodeString

user32

CharToOemBuffA
OemToCharBuffA

wsock32

ntohl
ioctlsocket
ord1108

iphlpapi

NhGetInterfaceNameFromDeviceGuid

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2a32010b0683a00f1a1c6066c0a61901

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

user32

wsock32

iphlpapi

Sections

.text Size: 10KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 43KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 802B

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 10KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 43KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 802B

UPX0
Size: 144KB - Virtual size: 380KB