511f765f4d9c17c267ddd400af4562c5271b134f8923118a05a4221d7c9f2901

General

Target

511f765f4d9c17c267ddd400af4562c5271b134f8923118a05a4221d7c9f2901
Size

39KB
MD5

a360ee28856994d66e41740810633310
SHA1

22da5f25d0b3f6a29105b1e1f389c51568b169c4
SHA256

511f765f4d9c17c267ddd400af4562c5271b134f8923118a05a4221d7c9f2901
SHA512

cafc435f1d1cdde23a13dabdc39458c5ea96d6f5252aa8d534e5231eb1d641c662844797cfe65bbd8e3850603f03c46d5353929cfd96dc30b10fd83cecd8dd69
SSDEEP

768:5ca2VYHUQDJkTPDYOm5ASQAVcVzJi17dJs:5cUxiPDYUSlcVYJs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

511f765f4d9c17c267ddd400af4562c5271b134f8923118a05a4221d7c9f2901
.exe windows x86

4f7ee12708e03bc5a90e08e36c4d4f79

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
ExitThread
SetEvent
GetTickCount
TerminateThread
WaitForSingleObject
CreateThread
CreateEventA
ReadFile
GetShortPathNameA
GetFileSize
_llseek
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetStartupInfoA
lstrcpyA
lstrcatA
GetEnvironmentVariableA
GetLastError
CreateFileA
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
OpenProcess
Sleep
GetModuleFileNameA
VirtualAlloc
VirtualFree
GetWindowsDirectoryA
GetSystemDirectoryA
FindFirstFileA
DeleteFileA

advapi32

CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
RegCloseKey
RegSetValueExA
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegQueryValueExA
CryptHashData

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??3@YAXPAX@Z
strcat
sprintf
memset
_except_handler3
_local_unwind2
memcmp
strncpy
strlen
strcmp
strstr
strcpy
__CxxFrameHandler
toupper
tolower
__dllonexit
_onexit

shell32

ShellExecuteA

Sections

UPX0
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4f7ee12708e03bc5a90e08e36c4d4f79

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

shell32

Sections

UPX0 Size: 20KB - Virtual size: 20KB

.avc Size: 2KB - Virtual size: 4KB

UPX0
Size: 20KB - Virtual size: 20KB

.avc
Size: 2KB - Virtual size: 4KB