50260b1c69745797dceff18dc732b2a78c7c2f60acea7c14762fd9c3df69316d

Sharing

Copy URL Twitter E-mail

General

Target

50260b1c69745797dceff18dc732b2a78c7c2f60acea7c14762fd9c3df69316d
Size

126KB
MD5

a136675a0966b74b5a10751989d98af0
SHA1

b5ec149c84d5b198e7203b0c4c987b719e16e493
SHA256

50260b1c69745797dceff18dc732b2a78c7c2f60acea7c14762fd9c3df69316d
SHA512

a2c843dd1857507221e2e3e3e8bd53056cf697fd29a319dc369dcb483a51ef3bf1cfd9eeba9387ae161bac6699d6905ce700745964e7ff732e64bab8ce246cb1
SSDEEP

3072:pTmy+JYzPqpJ2A7Kc/g08k895rLRYVArtWRJ/m7f3f6fKlSiw:E8qd2sVAta/Mn6SAiw

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

50260b1c69745797dceff18dc732b2a78c7c2f60acea7c14762fd9c3df69316d
.exe windows x86

5c1e93817ba53e0b1335f3e88b3310ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__set_app_type
__p__commode
__p__fmode
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcschr
_wcsicmp
wcslen
_except_handler3

advapi32

SaferComputeTokenFromLevel
CreateProcessWithLogonW
CredMarshalCredentialW
SaferGetPolicyInformation
SaferGetLevelInformation
SaferCreateLevel
CreateProcessAsUserW
SaferCloseLevel
CredUnmarshalCredentialW
CredFree
CryptAcquireContextW
CryptGetProvParam
CryptReleaseContext

kernel32

GetStartupInfoA
GetTickCount
GetCurrentThreadId
UnhandledExceptionFilter
GetCurrentProcessId
SetUnhandledExceptionFilter
TerminateProcess
GetStdHandle
GetCurrentProcess
GetExitCodeProcess
GetCurrentDirectoryW
GetCommandLineW
GetSystemTimeAsFileTime
GetLastError
lstrlenW
lstrcmpiW
lstrcpyW
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetExitCodeThread
WriteConsoleW
LocalFree
FormatMessageW
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentStringsW
QueryPerformanceCounter

credui

CredUIConfirmCredentialsW
CredUICmdLinePromptForCredentialsW

user32

LoadStringW

shell32

CommandLineToArgvW

secur32

GetUserNameExW

crypt32

CertGetNameStringW
CertOpenSystemStoreW
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty

netapi32

NetpGetDomainName
NetApiBufferFree
NetpGetComputerName

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5c1e93817ba53e0b1335f3e88b3310ae

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

credui

user32

shell32

secur32

crypt32

netapi32

Sections

.text Size: 10KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 6KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 10KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 6KB

.UPX0
Size: 108KB - Virtual size: 260KB