391cf4a7f880319204f9c456212cf2f3c45e88e0dc37cc61d1f251d3bbc5df42

Sharing

Copy URL Twitter E-mail

General

Target

391cf4a7f880319204f9c456212cf2f3c45e88e0dc37cc61d1f251d3bbc5df42
Size

289KB
MD5

a39c2d038df06d2f90b8fc5a0acaa991
SHA1

2fe5e5ba89209d084a61e7ee4b480a23a8152be7
SHA256

391cf4a7f880319204f9c456212cf2f3c45e88e0dc37cc61d1f251d3bbc5df42
SHA512

616df9b0f7f88b40492eb122684c4a68ad0c37c687054b570619908c22f1f1871eebd6cd6aa4a8db120d09880d3043ad9efebfaae55eb7638acc82ccca09ecc5
SSDEEP

6144:hBUR4TSgyAVmSAfrpjqFBx0koc9XsRHWmZjL0ImJRh:hBaAVm7vtIwjL0ImDh

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

391cf4a7f880319204f9c456212cf2f3c45e88e0dc37cc61d1f251d3bbc5df42
.exe windows x86

7180eebe4ae8aafbf54a4fa891244714

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_vsnwprintf
wcsrchr
??2@YAPAXI@Z
_ftol
realloc
_wtoi
wcsncmp
malloc
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
memmove
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
time
srand
_purecall
_except_handler3
_wsplitpath
_wmakepath
_wcsnicmp
wcscmp
_wtoi64
wcslen
wcsstr
__CxxFrameHandler
wcsncpy
_CxxThrowException
??3@YAXPAX@Z
free
_adjust_fdiv
rand
memset
wcscat
wcscpy
_wcsicmp
swprintf
_snwprintf
wcschr

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA

kernel32

WaitForSingleObject
GetFileAttributesW
GetModuleHandleW
GetUserDefaultLCID
GetSystemDefaultLCID
LoadLibraryExW
FreeLibrary
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
MulDiv
lstrlenW
GetLastError
CreateDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CloseHandle
CreateFileW
ReadFile
WriteFile
GetFileSize
GetFullPathNameW
HeapSize
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
SetLastError
lstrcpyW
lstrcmpW
FindClose
FindNextFileW
FindFirstFileW
LocalUnlock
LocalLock
lstrcmpiW
lstrcpynW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
SetUnhandledExceptionFilter
Sleep
CreateThread
CreateEventW
CreateMutexW
OpenMutexW
SetEvent
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetProcessShutdownParameters
GetCommandLineW
SetThreadExecutionState
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoW
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
GetVersionExA

gdi32

StretchBlt
GetObjectW
CreateCompatibleDC
SetBrushOrgEx
SetBkMode
DeleteDC
CreateBitmap
CreatePatternBrush
CreateCompatibleBitmap
BitBlt
GetStockObject
GetTextExtentPoint32W
SetTextColor
SetBkColor
CreateFontIndirectW
CreateSolidBrush
SelectObject
DeleteObject
PatBlt
ExtTextOutW
GetLayout
GetClipBox
GetDeviceCaps

user32

BeginPaint
EndPaint
InvalidateRect
ShowWindow
IsWindowVisible
IsWindow
FillRect
DrawTextW
DefWindowProcW
SetWindowLongW
GetWindowLongW
CallWindowProcW
PostQuitMessage
DestroyWindow
SendMessageW
CreateWindowExW
PostMessageW
SetWindowTextW
GetWindowRect
ClientToScreen
ScreenToClient
RedrawWindow
EnableWindow
SetFocus
SendDlgItemMessageW
GetDlgItem
MessageBoxW
SetWindowPos
MapWindowPoints
SystemParametersInfoW
GetWindow
GetParent
GetClassInfoExW
wsprintfW
LoadCursorW
ReleaseDC
GetDC
LoadBitmapW
GetWindowTextW
GetWindowTextLengthW
RegisterClassExW
RegisterWindowMessageW
DialogBoxParamW
GetSysColor
ReleaseCapture
SetCapture
InvalidateRgn
GetDesktopWindow
IsChild
GetFocus
GetClientRect
GetClassNameW
CharNextW
GetActiveWindow
CreateAcceleratorTableW
GetSystemMetrics
LoadIconW
LoadImageW
UnhookWindowsHookEx
GetAsyncKeyState
LockWorkStation
CallNextHookEx
SetWindowsHookExW
EndDialog
GetKeyState
DrawTextExW
SetCursor
UpdateWindow
TrackPopupMenu
GetSubMenu
SetTimer
KillTimer
wvsprintfW
DestroyMenu
LoadMenuW
PostThreadMessageW
CharUpperW
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
CreateDialogParamW
GetWindowThreadProcessId
EnumWindows
IsIconic
GetLastActivePopup
SetForegroundWindow
SetDlgItemTextW
FindWindowExW
EnumChildWindows
CheckMenuRadioItem
SetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetRawInputData
AppendMenuW
CreatePopupMenu
RegisterRawInputDevices
UnregisterClassW
DestroyAcceleratorTable
SetLayeredWindowAttributes
MoveWindow

shell32

SHGetMalloc
ShellExecuteW
SHGetDesktopFolder
SHGetFolderPathW

ole32

CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoInitialize
CreateClassMoniker
GetRunningObjectTable
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal

oleaut32

VarBstrCat
SysAllocString
DispGetParam
SysFreeString
SysStringLen
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
VarBstrCmp
SysAllocStringLen

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_Destroy
ImageList_EndDrag
InitCommonControlsEx
ImageList_GetIcon
ImageList_BeginDrag

shlwapi

StrFormatByteSizeW

winmm

timeSetEvent
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeKillEvent

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7180eebe4ae8aafbf54a4fa891244714

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

shell32

ole32

oleaut32

comctl32

shlwapi

winmm

wtsapi32

Sections

.text Size: 117KB - Virtual size: 117KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 25KB - Virtual size: 25KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 117KB - Virtual size: 117KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 25KB - Virtual size: 25KB

UPX0
Size: 144KB - Virtual size: 380KB