ccfaf125399643d182de3f5ab291c8a9185b816bd700b6d493de7e94651ed9c9

Sharing

Copy URL Twitter E-mail

General

Target

ccfaf125399643d182de3f5ab291c8a9185b816bd700b6d493de7e94651ed9c9
Size

163KB
MD5

a0e7b8d2d79df9cd22098a0bac9059b3
SHA1

869bccba4e7d7f9098ed0db5c929b5db9698daaf
SHA256

ccfaf125399643d182de3f5ab291c8a9185b816bd700b6d493de7e94651ed9c9
SHA512

76f646e85a76dabf2838a2d0f8f24741c9b54a24c8526db71d38dbd56b37c011437fe7e5c205b4875bc3c358a34ae6da538aa9ef05086058965ca71dd3b7b76c
SSDEEP

3072:rWBIsbFR6Hq02WkDCI02Dwa+ufkW8/t8akhHMZ5HA97w1TY:6/6kOjzapfV8/tyhIKBUk

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

ccfaf125399643d182de3f5ab291c8a9185b816bd700b6d493de7e94651ed9c9
.exe windows x86

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_acmdln
_cexit
_exit
_XcptFilter
_ismbblead
wcsncmp
_vsnprintf
_vscwprintf
_wcsnicmp
_wcsicmp
exit
__getmainargs
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_wtoi64
_wtoi
memset
_vsnwprintf
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type

advapi32

RevertToSelf
IsValidSid
GetLengthSid
CopySid
RegGetValueW
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
CreateProcessAsUserW
ImpersonateLoggedOnUser
ConvertSidToStringSidW
RegQueryValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW

kernel32

ReadProcessMemory
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
UnmapViewOfFile
CloseHandle
CreateProcessW
SetEvent
GetLastError
MapViewOfFile
Wow64RevertWow64FsRedirection
GetSystemDirectoryW
Wow64DisableWow64FsRedirection
IsWow64Process
GlobalFree
GetCommandLineW
HeapSetInformation
DeleteFileW
OpenProcess
GetSystemDefaultLCID
InterlockedIncrement
lstrlenW
InterlockedDecrement
CreateEventW
LocalFree
OutputDebugStringA
GetProcAddress
OpenMutexW
HeapFree
OpenPrivateNamespaceW
HeapAlloc
GetProcessHeap
WaitForSingleObject
GetModuleHandleW
OpenFileMappingW
ClosePrivateNamespace
CreateFileMappingW
GetApplicationRecoveryCallback

ole32

StringFromGUID2
CoInitialize
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize

oleaut32

SysAllocString
LoadRegTypeLi
SysFreeString
SysAllocStringLen
LoadTypeLibEx

shell32

CommandLineToArgvW
ShellExecuteExW

wer

WerpAddRegisteredDataToReport
WerpSetCallBack
WerReportSubmit
WerReportCloseHandle
WerReportAddDump
WerpEnumerateStoreStart
WerpEnumerateStoreNext
WerpOpenMachineQueue
WerpSubmitReportFromStore
WerpOpenUserQueue
WerpCloseStore
WerpShowNXNotification
WerpIsTransportAvailable
WerpSetReportInformation
WerpGetReportInformation
WerpGetReportType
WerpLoadReport

user32

CloseWindowStation
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
CloseDesktop

ntdll

RtlAllocateAndInitializeSid
RtlCreateBoundaryDescriptor
RtlCreateServiceSid
RtlAddSIDToBoundaryDescriptor
RtlDeleteBoundaryDescriptor
NtQueryInformationProcess
RtlInitUnicodeString
NtQueryInformationToken
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

wer

user32

ntdll

Sections

.text Size: 45KB - Virtual size: 45KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 45KB - Virtual size: 45KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB

.UPX0
Size: 108KB - Virtual size: 260KB