9cb4b562641916fce78c3d871a1ff97e6cc70c3496db22ae1659e6da6f21c5a7

Sharing

Copy URL Twitter E-mail

General

Target

9cb4b562641916fce78c3d871a1ff97e6cc70c3496db22ae1659e6da6f21c5a7
Size

390KB
MD5

06f00a009b32dd6d847f12c06eeaf2a6
SHA1

db8fb41059b54b87b92bf9fa5ef2a4c003f62bc4
SHA256

9cb4b562641916fce78c3d871a1ff97e6cc70c3496db22ae1659e6da6f21c5a7
SHA512

265fbd872b2e09483d974b0b80f9c612b1b8366f9fccc7fa0dd4f7e30d11d88d742ba7079849bafe1d29569399eca35eba6e9da9e7781fe4833f2557575596bf
SSDEEP

6144:kcdDUnA5lY0jhLKIHT5v7C5Teazau8kZHIZxlJXCs:ZUnAdLKkOUamu8kNIZxlBCs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

9cb4b562641916fce78c3d871a1ff97e6cc70c3496db22ae1659e6da6f21c5a7
.exe windows x86

618ff39ed433204da61de1201b6d4b9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_controlfp
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
_vsnwprintf
swscanf
wcscmp
fclose
wcscpy
wcsstr
wcstol
malloc
free
_wcsicmp
_ftol
_beginthreadex
_CIpow
_purecall
_itow
wcslen
_wfopen
fputws
??3@YAXPAX@Z

atl

ord18
ord20
ord17
ord23
ord57
ord16
ord45
ord44
ord43
ord58
ord32
ord30

advapi32

OpenProcessToken
RegSetValueW
OpenThreadToken
RegDeleteKeyW
RegCreateKeyW
GetTokenInformation
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSid
GetLengthSid
CopySid
InitializeSecurityDescriptor
RegOpenKeyW
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegEnumKeyW
RegCloseKey
RegQueryValueExW

kernel32

LoadLibraryW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
CreateFileW
LoadLibraryA
VirtualFree
VirtualAlloc
GetSystemDirectoryW
VerSetConditionMask
CompareStringW
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoW
GlobalDeleteAtom
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
GetTickCount
ReleaseMutex
SetThreadExecutionState
SetEvent
WaitForSingleObject
UnmapViewOfFile
QueueUserAPC
MapViewOfFile
CreateFileMappingW
CreateMutexW
CreateEventW
DuplicateHandle
GetCurrentProcess
OpenProcess
InterlockedIncrement
InterlockedDecrement
GetLastError
ReadFile
WaitForMultipleObjects
QueryPerformanceCounter
lstrlenW
CancelWaitableTimer
SetWaitableTimer
CloseHandle
CancelIo
ResetEvent
GetOverlappedResult
GetCurrentThreadId
SetThreadPriority
GetCurrentThread
QueryPerformanceFrequency
CreateWaitableTimerW
FlushInstructionCache
InterlockedExchange
InterlockedCompareExchange
SetLastError
FreeLibrary
GetProcAddress
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
OpenEventW
SetProcessShutdownParameters
SetPriorityClass
GlobalAddAtomW
VerifyVersionInfoW
MulDiv
HeapAlloc

gdi32

CreateCompatibleBitmap
SelectObject
DeleteDC
CreateCompatibleDC
GetDeviceCaps
CreateSolidBrush
DeleteObject

user32

MonitorFromPoint
CallWindowProcW
DefWindowProcW
GetThreadDesktop
SetThreadDesktop
OpenInputDesktop
OpenDesktopW
GetUserObjectInformationW
CloseDesktop
CharNextW
GetPropW
PtInRect
ClientToScreen
GetClientRect
GetAncestor
GetWindowLongW
IsWindow
SetCursorPos
PostMessageW
SendInput
GetSystemMetrics
EnumDisplaySettingsW
ShowWindow
MoveWindow
ReleaseDC
GetDC
GetDesktopWindow
UpdateLayeredWindow
DrawIconEx
FillRect
GetSysColor
GetSysColorBrush
UnregisterDeviceNotification
RegisterDeviceNotificationW
DestroyWindow
SetWindowLongW
CreateWindowExW
RegisterWindowMessageW
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
DispatchMessageW
GetMessageW
GetMonitorInfoW
MonitorFromWindow
LoadStringW
PostThreadMessageW
DestroyIcon
LoadImageW
SystemParametersInfoW
GetDoubleClickTime
WindowFromPoint
InflateRect
EnumDisplayMonitors

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

hid

HidP_GetCaps
HidD_GetAttributes
HidD_GetPreparsedData
HidP_MaxUsageListLength
HidP_GetSpecificValueCaps
HidP_GetSpecificButtonCaps
HidD_FreePreparsedData
HidP_GetUsageValue
HidD_GetProductString
HidD_GetHidGuid
HidP_GetUsages

ole32

CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadRegTypeLi

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

618ff39ed433204da61de1201b6d4b9a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

advapi32

kernel32

gdi32

user32

msvcp60

hid

ole32

oleaut32

setupapi

Sections

.text Size: 149KB - Virtual size: 149KB

.data Size: 26KB - Virtual size: 26KB

.rsrc Size: 109KB - Virtual size: 109KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 149KB - Virtual size: 149KB

.data
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 109KB - Virtual size: 109KB

.UPX0
Size: 104KB - Virtual size: 252KB