616c248b0ff5940e4485885393262767b1a494d23e474d7ce0ce1c627478e8fb

Sharing

Copy URL Twitter E-mail

General

Target

616c248b0ff5940e4485885393262767b1a494d23e474d7ce0ce1c627478e8fb
Size

284KB
MD5

0ba90ef9d9d7541831db9bda6f3278d0
SHA1

507acad951798296ae063f10862dc61932784912
SHA256

616c248b0ff5940e4485885393262767b1a494d23e474d7ce0ce1c627478e8fb
SHA512

d2ce4120de5da08aed7e0d4e16af85555de791773afe87949d8289304c7a9590a4504651ae64bec9baaa876810d5c656ebef0a5fd87fc2d8072826bca0107253
SSDEEP

6144:95DupdwjQkUjU8gVBXLneW1VzY/gl2axyFN29egfyII9P49:LqGUj2eWc/T9YegEg

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

616c248b0ff5940e4485885393262767b1a494d23e474d7ce0ce1c627478e8fb
.exe windows x86

2e0c19f7c778673fbf330a549ecaacb5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
GetModuleBaseNameA

kernel32

SetFilePointer
FlushFileBuffers
FindClose
FindFirstFileA
GetFullPathNameA
FileTimeToLocalFileTime
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
GetDriveTypeA
GetProcessHeap
GetStartupInfoA
RaiseException
HeapSize
ExitProcess
GetACP
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
LCMapStringW
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetOEMCP
GetCPInfo
GetLocaleInfoA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
FileTimeToSystemTime
GetThreadLocale
GlobalGetAtomNameA
GlobalFlags
InterlockedIncrement
InterlockedDecrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
lstrcmpA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceA
LoadResource
LockResource
SizeofResource
SetLastError
GetCommandLineA
GetCurrentThreadId
GetTickCount
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleA
lstrlenA
CompareStringW
CompareStringA
FormatMessageA
LocalFree
CloseHandle
WriteFile
OutputDebugStringA
GetCurrentProcess
GetTempPathA
CreateFileA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
UnhandledExceptionFilter

user32

PostQuitMessage
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetSystemMetrics
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
RegisterWindowMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
PostMessageA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowTextA
SetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetKeyState
ValidateRect
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent

gdi32

DeleteDC
GetStockObject
SetViewportOrgEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
GetDeviceCaps
SelectObject
Escape
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
OffsetViewportOrgEx

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA
GetPrinterDriverDirectoryA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

LaunchApplications
LoadIniFile
LoadPnPLaunch
LocateIniFile

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2e0c19f7c778673fbf330a549ecaacb5

Headers

File Characteristics

Imports

psapi

kernel32

user32

gdi32

winspool.drv

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 4KB - Virtual size: 984B

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 4KB - Virtual size: 984B

.UPX0
Size: 108KB - Virtual size: 260KB