82768669f72ef252a04347dddd01763b5e494eb81f43beb41700f9575718e97e

Sharing

Copy URL

Twitter E-mail

General

Target

82768669f72ef252a04347dddd01763b5e494eb81f43beb41700f9575718e97e
Size

190KB
MD5

934757db91d090e4efa140930351ec99
SHA1

97a014c0ad05ece0fdeedb2f38ae3406afcdb700
SHA256

82768669f72ef252a04347dddd01763b5e494eb81f43beb41700f9575718e97e
SHA512

8dc6ae426f3ca4d1da597c566bf6102abf23e33a32e3f6ab4f1236631cca7b30a4926d0aba14e82f2adb7fca106f817228a4dd006830973cca24d5058fc2b254
SSDEEP

3072:8cMCkiYuo6V+cbUCzdb/S5xqSy9rIqlUSlC5+nTqFTtWhCa7O69OuhBMMnO:8cvnLV+chzdKi9rDUSo5+nTqhtWhB+O6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

82768669f72ef252a04347dddd01763b5e494eb81f43beb41700f9575718e97e
.exe windows x86

ba9b826b610ea2e2dc4e47261a6c5e6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
CreateEventW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetEvent
SetUnhandledExceptionFilter
LocalFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
CreateThread
SetLastError
TerminateThread
SetConsoleCtrlHandler
QueueUserAPC
OpenThread
SleepEx
lstrcmpiW
InterlockedIncrement
GetCurrentThreadId
IsDebuggerPresent
CloseHandle
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObject
GetLastError
UnhandledExceptionFilter

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
wcslen
_purecall
free
wcscmp
malloc
__wgetmainargs
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
__winitenv
exit
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_except_handler3
_controlfp

advapi32

RegisterTraceGuidsW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
LookupAccountSidW
CreateWellKnownSid
TraceMessage

setupapi

SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

ntdll

DbgBreakPoint

rpcrt4

RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcStringFreeW
RpcServerListen
RpcAsyncCompleteCall
RpcServerInqCallAttributesW
NdrServerCall2
NdrAsyncServerCall
RpcServerRegisterIfEx
RpcServerUseProtseqEpW

secur32

GetUserNameExW

user32

LoadIconW
LoadCursorW
RegisterClassW
CreateWindowExW
SetWindowLongW
DestroyWindow
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowLongW
DefWindowProcW
PostQuitMessage
PostMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW

Exports

Exports

WdfDeviceCreate
WdfDeviceGetDeviceName
WdfDeviceGetIoTarget
WdfDeviceInitSetFileEventCallbacks
WdfDeviceRegisterIoCallbacks
WdfDriverCreate
WdfFdoInitSetEventCallbacks
WdfFdoInitSetFilter
WdfIoQueueGetDevice
WdfIoTargetFormatIoctlRequest
WdfMemoryBufferCreate
WdfObjectDereferenceActual
WdfObjectReferenceActual
WdfRequestComplete
WdfRequestCompleteWithInformation
WdfRequestCreate
WdfRequestGetParameters
WdfRequestRetrieveBuffer
WdfRequestSend
WdfRequestSetCompletionRoutine

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ba9b826b610ea2e2dc4e47261a6c5e6d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

setupapi

ntdll

rpcrt4

secur32

user32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 512B - Virtual size: 572B

.rsrc Size: 1KB - Virtual size: 1KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 512B - Virtual size: 572B

.rsrc
Size: 1KB - Virtual size: 1KB

UPX0
Size: 144KB - Virtual size: 380KB