c72e55c75d080115ca1f623c4ff05b5226e31cf2f2a39140e259b5ddb0ae927a

Sharing

Copy URL Twitter E-mail

General

Target

c72e55c75d080115ca1f623c4ff05b5226e31cf2f2a39140e259b5ddb0ae927a
Size

260KB
MD5

928e17a72780302acb9607831d4b6c2d
SHA1

863ff8b78adbedc6662f30216487478e99a483d1
SHA256

c72e55c75d080115ca1f623c4ff05b5226e31cf2f2a39140e259b5ddb0ae927a
SHA512

94df4798ccaaf7b6c4112e66b0fffa41a2c1a218d0f6b2fcc021a2e81a9fd05d875e93d91d6121b0060e19c38ad2ce6e117b44ad62e8436a3a677e7970a2cbaf
SSDEEP

6144:l95fMN08D5C9URxBI33REkszqPrVyHZRRAlf2NHB4:lkN08DrjA7XQ56ONHB4

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

c72e55c75d080115ca1f623c4ff05b5226e31cf2f2a39140e259b5ddb0ae927a
.exe windows x86

1947e314bb7c10d20bdefcc30207bb29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA

kernel32

SizeofResource
LockResource
LoadResource
FindResourceW
LocalAlloc
LocalFree
lstrcmpW
GetProcAddress
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
ExitProcess
GetModuleHandleA
WriteFile
GlobalHandle
GetModuleFileNameA
LoadLibraryW
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
GetLocaleInfoA
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
GetSystemDirectoryW
FreeLibrary
WideCharToMultiByte
GlobalReAlloc
CloseHandle
GlobalAlloc
FreeEnvironmentStringsA
GlobalLock
SetStdHandle
SetFilePointer
GlobalUnlock
GlobalFree
CreateFileW
GetStdHandle
FlushFileBuffers

gdi32

CreateCompatibleBitmap
SelectObject
CreateSolidBrush
DeleteDC
BitBlt
DeleteObject
CreateCompatibleDC

user32

SetScrollPos
GetWindowLongW
SubtractRect
MapWindowPoints
GetForegroundWindow
GetFocus
GetDlgCtrlID
KillTimer
EnableWindow
ShowWindow
GetWindow
EndPaint
DrawEdge
BeginPaint
DestroyWindow
SetFocus
SetForegroundWindow
SetWindowPos
OffsetRect
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetDesktopWindow
WinHelpW
DestroyIcon
SetPropW
SetWindowLongW
EnableMenuItem
CreateWindowExW
MonitorFromRect
GetSystemMetrics
SetScrollInfo
GetClientRect
LoadIconW
MoveWindow
IsIconic
RemovePropW
RegisterClassW
DefDlgProcW
LoadCursorW
CreateDialogIndirectParamW
PostQuitMessage
DefWindowProcW
UnhookWindowsHook
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
FindWindowW
SetWindowsHookW
LoadStringW
IsWindowEnabled
IsDlgButtonChecked
CheckRadioButton
EndDialog
DialogBoxParamW
FillRect
GetSysColor
GetUpdateRect
InvalidateRect
SetWindowTextW
MessageBoxW
MapDialogRect
GetWindowRect
PostMessageW
IsWindow
GetWindowTextW
SendMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetPropW
CallWindowProcW
LoadImageW
GetDlgItem
CheckMenuItem
GetMenu
ScrollWindowEx

shell32

ShellAboutW

winmm

mixerGetLineControlsW
mixerSetControlDetails
waveOutGetDevCapsW
midiOutGetDevCapsW
midiOutGetNumDevs
auxGetDevCapsW
auxGetNumDevs
waveOutMessage
waveInMessage
mixerGetNumDevs
waveInGetNumDevs
waveOutGetNumDevs
mixerOpen
mixerClose
timeKillEvent
timeSetEvent
mixerGetDevCapsW
mixerGetLineInfoW
mixerGetID
mixerMessage
PlaySoundW
mixerGetControlDetailsW

comctl32

ord17

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceW
SetupDiCreateDeviceInfoList
SetupDiOpenDevRegKey

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1947e314bb7c10d20bdefcc30207bb29

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

shell32

winmm

comctl32

setupapi

Sections

.text Size: 69KB - Virtual size: 68KB

.data Size: 2KB - Virtual size: 11KB

.rsrc Size: 79KB - Virtual size: 79KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 69KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 11KB

.rsrc
Size: 79KB - Virtual size: 79KB

.UPX0
Size: 108KB - Virtual size: 260KB