8888dbb90af8ef3506eaf387d41f38221af3585756c7c4d793e3360ff91535b1

Sharing

Copy URL Twitter E-mail

General

Target

8888dbb90af8ef3506eaf387d41f38221af3585756c7c4d793e3360ff91535b1
Size

70KB
MD5

841acd610c24d9c933f3c3ddbaa8e2f0
SHA1

b0fc26c434a39518b16074168a53ae18a0d11349
SHA256

8888dbb90af8ef3506eaf387d41f38221af3585756c7c4d793e3360ff91535b1
SHA512

3b228e6506b611568f24d8e6b2570c70ad7631827f732a4dc6ddf9eb53c67037ecda5cde4759db1cd1ddb2064d49a109e6be23b1744c990fb32feb6696ec0db9
SSDEEP

1536:sbmI4RmOgwiS4pN9WmCNWEAZpungOzp+edWTgLrpp:sFYmOgwinsNWqngwUY

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

8888dbb90af8ef3506eaf387d41f38221af3585756c7c4d793e3360ff91535b1
.exe windows x86

f34f02ee36051c5c89432f3ce8fc9e1e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
OutputDebugStringA
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceCounter
Sleep

user32

MessageBoxA

ole32

CoInitialize
CoUninitialize

riotlauncher

Maestro_Remove
MaestroServerController_Remove
MaestroServerController_Init
Maestro_Init
MaestroServerController_StartArgs
MaestroServerController_VerifyAllNeededFilesExist
Maestro_Log

ws2_32

WSACleanup
WSAStartup

winmm

timeGetTime

msvcr80

vsprintf
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
??3@YAXPAX@Z
_purecall
_mbscmp
__CxxFrameHandler3
memset
memcpy

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f34f02ee36051c5c89432f3ce8fc9e1e

Headers

File Characteristics

Imports

kernel32

user32

ole32

riotlauncher

ws2_32

winmm

msvcr80

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 428B

.reloc Size: 2KB - Virtual size: 2KB

.UPX Size: 57KB - Virtual size: 60KB

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 428B

.reloc
Size: 2KB - Virtual size: 2KB

.UPX
Size: 57KB - Virtual size: 60KB