f2b65703140d18cff2ae42a21711d1abced3b3bb6d877dc8f9a4241d4b817bd8

Sharing

Copy URL Twitter E-mail

General

Target

f2b65703140d18cff2ae42a21711d1abced3b3bb6d877dc8f9a4241d4b817bd8
Size

372KB
MD5

83f1f98df7539759ffee3f25bac1f482
SHA1

161d8f9c4a28938df53bbb2ad6fb16eabf643d67
SHA256

f2b65703140d18cff2ae42a21711d1abced3b3bb6d877dc8f9a4241d4b817bd8
SHA512

529361fd30d02e0efc41b26c8474acdc0dac47efd8e56ccf9b12c254eae14d5180eced30097740dabbee03df795344f291052215cd0e25ce9faad6468c358b24
SSDEEP

6144:MEJjIcSrBirNOQ+n72k9Xg+Lo1hZ1B5tu5ox6Pgj:MEJjIcs8rNOQ+X+1hZFtGs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

f2b65703140d18cff2ae42a21711d1abced3b3bb6d877dc8f9a4241d4b817bd8
.exe windows x86

a96532f173220d98cb4bf06ac24a6b92

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasEnumConnectionsA
RasEnumDevicesA
RasSetEntryPropertiesA
RasDeleteEntryA
RasDialA
RasGetErrorStringA
RasHangUpA
RasGetConnectStatusA

kernel32

GetFileAttributesA
GetFileSize
GetFileTime
RtlUnwind
GetStartupInfoA
GetCommandLineA
ExitProcess
RaiseException
TerminateProcess
HeapReAlloc
HeapSize
GetTimeZoneInformation
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetErrorMode
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetShortPathNameA
GetFullPathNameA
GetProfileStringA
Sleep
lstrcpyA
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalAlloc
InterlockedDecrement
InterlockedIncrement
lstrcmpiA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
lstrcpynA
GetCurrentThreadId
GetCurrentThread
lstrcmpA
GlobalDeleteAtom
GlobalLock
GetModuleFileNameA
CloseHandle
LoadResource
FindResourceA
LockResource
GlobalUnlock
GetTickCount
GetProcAddress
GetModuleHandleA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
FormatMessageA
GetOEMCP
GetCPInfo
GetThreadLocale
SizeofResource
WritePrivateProfileStringA
FileTimeToLocalFileTime
FileTimeToSystemTime
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalFree
LocalAlloc
GetLastError
GlobalFlags
GetProcessVersion
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MulDiv
SetLastError
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA

user32

CharNextA
CopyAcceleratorTableA
SetRect
GetNextDlgGroupItem
MessageBeep
CharUpperA
InvalidateRect
InflateRect
DestroyIcon
GetDesktopWindow
PtInRect
GetClassNameA
GetSysColorBrush
LoadCursorA
DestroyMenu
LoadStringA
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
MoveWindow
IsDialogMessageA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
ScreenToClient
PostThreadMessageA
GetTopWindow
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SetWindowTextA
SendMessageA
LoadIconA
SetFocus
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
RegisterClipboardFormatA
EndDialog
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
CopyRect
GetMessageA
TranslateMessage
DrawFocusRect
DefDlgProcA
IsWindowUnicode
SetTimer
GetDlgItem
AppendMenuA
GetSystemMenu
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
KillTimer
ShowWindow
MessageBoxA
EnableWindow
GetNextDlgTabItem
GetParent
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
UnhookWindowsHookEx
PostMessageA
PostQuitMessage
SetCursor
GetWindowLongA
IsWindowEnabled
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
DeleteObject
SetBkMode
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextColor
GetBkColor
DPtoLP
LPtoDP
GetMapMode
PatBlt
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
CreateDIBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateFontA

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegSetValueA
RegQueryValueA
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA

shell32

ExtractIconA
ShellExecuteA

comctl32

ord17

oledlg

ord8

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
OleIsCurrentClipboard
OleFlushClipboard
CoGetClassObject
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter

olepro32

ord253

oleaut32

VariantCopy
VariantClear
VariantChangeType
SysAllocStringLen
SysFreeString
SysAllocString
SysStringByteLen
SysStringLen
VariantTimeToSystemTime
SysAllocStringByteLen
LoadTypeLi

Sections

.text
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a96532f173220d98cb4bf06ac24a6b92

Headers

File Characteristics

Imports

rasapi32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 148KB - Virtual size: 146KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 20KB - Virtual size: 36KB

.rsrc Size: 16KB - Virtual size: 14KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 148KB - Virtual size: 146KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 20KB - Virtual size: 36KB

.rsrc
Size: 16KB - Virtual size: 14KB

UPX0
Size: 144KB - Virtual size: 380KB