b8f1cbecf058c41e733204f4aa9d4785c68e1da861eb9d2f84b84b6318eac696

Sharing

Copy URL

Twitter E-mail

General

Target

b8f1cbecf058c41e733204f4aa9d4785c68e1da861eb9d2f84b84b6318eac696
Size

516KB
MD5

826a66b8c7dae4b2be09e6fbf13f3d41
SHA1

b3126d4e83bd019e32ab3d978051aeccdf45501f
SHA256

b8f1cbecf058c41e733204f4aa9d4785c68e1da861eb9d2f84b84b6318eac696
SHA512

a3bda3ea78c90ff08f1085c4d7b914f6f690fe8cde443e37d23849085f7b5645d00cb92ac6aed335ebe63100543360a28444038493d3082b006be5ab597cacff
SSDEEP

12288:QHU0ZQ0fvnUMq1h84MVArET47YKUdYK5/7+XST5l:QHU0ZQ0fvnC1hpMVAQTBKeYK5aXO5

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

b8f1cbecf058c41e733204f4aa9d4785c68e1da861eb9d2f84b84b6318eac696
.exe windows x86

8b503f92675df4ff31878cc69e4a8b7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
GetCurrentDirectoryA
CopyFileA
Sleep
DeleteFileA
SetFileAttributesA
GetShortPathNameA
WaitForSingleObject
SetEvent
CreateEventA
GetTickCount
GetFileSize
CreateFileA
GetLocalTime
ReadFile
SetFilePointerEx
AllocConsole
FreeConsole
SetFilePointer
GetStdHandle
WriteFile
GetTempFileNameA
GetTempPathA
GetCurrentThreadId
SuspendThread
ResumeThread
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
MoveFileExA
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
lstrlenA
LocalFree
LocalAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
RaiseException
DeviceIoControl
lstrcatA
GetSystemDirectoryA
lstrcpyA
HeapReAlloc
SetLastError
GlobalAlloc
GlobalFree
GetFileInformationByHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetLocaleInfoW
FlushFileBuffers
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
VirtualQuery
SetStdHandle
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CreateMutexA
WideCharToMultiByte
GetModuleFileNameA
OutputDebugStringA
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
GetLastError
LoadLibraryA
GetProcAddress
GetProcessHeap
HeapFree
HeapAlloc
OpenProcess
CloseHandle
FreeLibrary
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
UnhandledExceptionFilter
GetOEMCP
HeapSize
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetCPInfo
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitProcess
RtlUnwind
InterlockedIncrement
InterlockedDecrement
PeekNamedPipe

user32

RegisterClassExA
PostThreadMessageA
PeekMessageA
IsCharAlphaNumericA
wsprintfA
CreateWindowExA
UpdateWindow
SetTimer
DefWindowProcA
FindWindowA
PostQuitMessage
KillTimer
DestroyWindow
GetMessageA
DispatchMessageA
TranslateMessage

gdi32

DeleteObject

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocString

shlwapi

SHSetValueA
PathRenameExtensionA
PathFindExtensionA
SHGetValueA
PathFileExistsA

wsock32

htons
closesocket
getsockname
inet_addr
bind
sendto
connect
WSAGetLastError
gethostbyname
ioctlsocket
accept
inet_ntoa
getpeername
recv
WSACleanup
ntohs
listen
shutdown
WSAStartup
send
socket

wininet

InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetCloseHandle

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8b503f92675df4ff31878cc69e4a8b7a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

wsock32

wininet

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 8KB - Virtual size: 29KB

.rsrc Size: 52KB - Virtual size: 49KB

.UPX Size: 240KB - Virtual size: 240KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 8KB - Virtual size: 29KB

.rsrc
Size: 52KB - Virtual size: 49KB

.UPX
Size: 240KB - Virtual size: 240KB