2bc75fa0eea1a6d79bc2b1751d8f7fa37bdd147c12d48c10a2cdee7d8b1f401a

Sharing

Copy URL Twitter E-mail

General

Target

2bc75fa0eea1a6d79bc2b1751d8f7fa37bdd147c12d48c10a2cdee7d8b1f401a
Size

495KB
MD5

90f36bdec0ecadc4c6f9b62310546361
SHA1

e2c4fe4f0aa959469a3fbaa105e39161d0eac76a
SHA256

2bc75fa0eea1a6d79bc2b1751d8f7fa37bdd147c12d48c10a2cdee7d8b1f401a
SHA512

7326cad3404167d85c7b61b36da272e620b38e69cfe08006af8e38fe30f3ef45af68fcd78e9de2482df88686bec0f02a5b519265b623e066bb4e17479315a42a
SSDEEP

12288:ClAHH0rZg4f4CIJ5MZ0wsF8Pl54xxx1+bt5W9BJ4:3HiZg4f4CIaReg

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

2bc75fa0eea1a6d79bc2b1751d8f7fa37bdd147c12d48c10a2cdee7d8b1f401a
.exe windows x86

aa5795f627534a10c671ed5e2d715a46

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

kernel32

GetTickCount
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
SetLastError
lstrlenA
MultiByteToWideChar
CreateMutexW
ReleaseMutex
GetVersionExW
Sleep
GetSystemDefaultUILanguage
CreateFileW
WriteFile
CloseHandle
EnterCriticalSection
LeaveCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
HeapSetInformation
RegisterApplicationRestart
DeleteFileW
GetProcAddress
WideCharToMultiByte
FreeLibrary
ExpandEnvironmentStringsW
LoadLibraryW
GetTempPathW
GlobalDeleteAtom
GlobalAddAtomW
RaiseException
GetLastError
QueryPerformanceCounter

gdi32

CreateSolidBrush
CreatePen
CreateCompatibleBitmap
Rectangle
SelectObject
GetStockObject
CombineRgn
CreateRectRgn
CreateRectRgnIndirect
GetDeviceCaps
DeleteObject
SetBkMode
SetTextColor
SelectClipRgn
GetClipRgn
GetLayout
FillRgn
OffsetRgn
CreatePolygonRgn
GetObjectW
DeleteDC
CreateCompatibleDC
PatBlt
BitBlt
SetLayout
CreateDIBSection

user32

MapWindowPoints
UnregisterClassA
SetFocus
LoadMenuW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetWindowRect
RegisterHotKey
CreateWindowExW
LoadStringW
GetForegroundWindow
SetWindowTextW
AdjustWindowRect
GetWindowTextW
GetWindowRgnBox
OffsetRect
SetClassLongW
LoadCursorW
UnionRect
IntersectRect
SetRect
LogicalToPhysicalPoint
GetWindowLongW
GetSystemMetrics
SetPropW
EnumDisplayMonitors
SetScrollInfo
PtInRect
IsIconic
IsWindowVisible
InvalidateRect
SetCapture
ReleaseCapture
DefWindowProcW
EndPaint
BeginPaint
GetWindow
ShowWindow
RegisterClassW
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
PostQuitMessage
UnregisterHotKey
IsZoomed
CallWindowProcW
SetCursor
GetIconInfo
DrawIconEx
CheckMenuRadioItem
LoadIconW
LoadImageW
AdjustWindowRectEx
SystemParametersInfoW
SetWindowLongW
DestroyMenu
TranslateAcceleratorW
DestroyWindow
DialogBoxParamW
GetClientRect
EndDialog
CheckDlgButton
FillRect
GetSubMenu
GetMonitorInfoW
MonitorFromWindow
CopyRect
TrackPopupMenuEx
GetProcessDefaultLayout
GetPropW
GetScrollInfo
GetWindowDC
GetDesktopWindow
SetWindowPos
ReleaseDC
PostMessageW
InflateRect
DrawTextW
DrawFocusRect
IsDlgButtonChecked
GetDlgItem
SendMessageW
LoadAcceleratorsW
GetMessageW
TranslateMessage
DispatchMessageW
GetDC
FindWindowW
OpenIcon
SetForegroundWindow
MessageBoxW
GetSysColor

msvcrt

memcpy
??3@YAXPAX@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
free
_vsnwprintf
memset
??_U@YAPAXI@Z
_CxxThrowException
??2@YAPAXI@Z
_ftol2_sse
memcpy_s
malloc
_controlfp
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
strstr
vswprintf_s
_vscwprintf
_resetstkoflw
memmove_s
wcscspn
wcsspn
_wcsicmp

ntdll

WinSqmIncrementDWORD
WinSqmIsOptedIn
EtwTraceMessage

gdiplus

GdipSaveImageToStream
GdipCreateFontFromLogfontW
GdipCreateFontFromDC
GdipMeasureString
GdipDrawString
GdipFillRectangle
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCreateLineBrushFromRect
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneImage
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusShutdown
GdiplusStartup
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteGraphics
GdipDeleteBrush
GdipAlloc
GdipFree
GdipGetImageEncoders

comctl32

InitCommonControlsEx
ImageList_Add
ImageList_Create
ImageList_Destroy
ord380
ord345

shlwapi

PathFindExtensionW
UrlCreateFromPathW
StrStrA
PathIsURLW
ord487
StrChrW
PathFindFileNameW
SHRegGetUSValueW
ord158
PathRemoveExtensionW

shell32

SHCreateItemInKnownFolder
ord75
ShellAboutW

ole32

CoCreateGuid
CoTaskMemFree
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
StringFromCLSID

oleaut32

SysAllocStringLen
VarBstrCat
SysStringLen
SafeArrayGetUBound
SafeArrayGetElement
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayPutElement

uxtheme

GetThemeSysColor
GetThemeSysFont

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aa5795f627534a10c671ed5e2d715a46

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 3KB - Virtual size: 9KB

.rsrc Size: 246KB - Virtual size: 246KB

.reloc Size: 6KB - Virtual size: 6KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 3KB - Virtual size: 9KB

.rsrc
Size: 246KB - Virtual size: 246KB

.reloc
Size: 6KB - Virtual size: 6KB

.UPX0
Size: 108KB - Virtual size: 260KB