1f756e6bc9d6eea2b756ab36a4c9c8682e77a696b5d5707c987e0d27b2e9a276

Sharing

Copy URL Twitter E-mail

General

Target

1f756e6bc9d6eea2b756ab36a4c9c8682e77a696b5d5707c987e0d27b2e9a276
Size

1.0MB
MD5

0e4d6685d7d3605a7e168dfff300a3d9
SHA1

65ab0af79fb782353268c73f3da703be822f8dfb
SHA256

1f756e6bc9d6eea2b756ab36a4c9c8682e77a696b5d5707c987e0d27b2e9a276
SHA512

362a566ac1526b068e5c7a34a3c269ecddfb6a3b6d20b379a1cf08752912ff0648ac786766a982d916c7678b4908738f89137becf5e9abf1cc5480f1d8649f5a
SSDEEP

12288:bKqiVtLZ51qviizQBODAgANJCkylkQ5ZS5XtW5Z75ZQ5Zwjh+5fLW:bKDn5kRzAgANjcpmoj6G1+5f6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

1f756e6bc9d6eea2b756ab36a4c9c8682e77a696b5d5707c987e0d27b2e9a276
.exe windows x86

3a378dd5879a3ea3c69b22cebe1e3fa0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
TraceEvent
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegGetValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids

kernel32

LocalAlloc
GetSystemPowerStatus
FormatMessageW
SetEvent
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
LocalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
CreateProcessW
CloseHandle
CreateThread
GetCommandLineW
InterlockedExchange
GetVersionExA
lstrcmpW
HeapSetInformation
CreateMutexW
ReleaseMutex
RegisterApplicationRestart
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
SystemTimeToFileTime
CompareFileTime
FreeLibrary
GetProcAddress
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
VirtualFree
VirtualAlloc
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
RaiseException
GetLastError

gdi32

Polygon
SetWindowOrgEx
GetBkColor
SetBkColor
GetTextExtentPoint32W
CreateRectRgn
SelectClipRgn
GetLayout
SetLayout
SetViewportOrgEx
SetBrushOrgEx
BitBlt
GdiGradientFill
SetDCPenColor
MoveToEx
LineTo
CreateDIBSection
GdiAlphaBlend
SetTextColor
SetBkMode
GetStockObject
CreateDCW
DeleteDC
GetTextMetricsW
SelectObject
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
CreateSolidBrush
GetObjectW
OffsetWindowOrgEx

user32

UpdateWindow
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SetWindowLongW
GetSysColorBrush
SystemParametersInfoW
GetSystemMetrics
GetSysColor
LoadCursorW
ChangeDisplaySettingsExW
EnumDisplaySettingsExW
LoadStringW
PostMessageW
GetDlgItem
RegisterDeviceNotificationW
GetClassLongW
SendMessageW
EndPaint
BeginPaint
PtInRect
SetRect
DrawEdge
UnregisterClassA
DestroyIcon
FrameRect
DrawFocusRect
CopyRect
InflateRect
DrawIconEx
GetWindowPlacement
GetWindowRect
MoveWindow
DefWindowProcW
GetWindowLongW
PostQuitMessage
GetParent
CreateWindowExW
GetClientRect
MapWindowPoints
OffsetRect
DestroyWindow
SetForegroundWindow
GetForegroundWindow
IsIconic
ShowWindow
CallWindowProcW
SetWindowTextW
GetWindowTextW
EnumChildWindows
SetDlgItemTextW
EnableWindow
GetDC
ReleaseDC
SetClassLongW
NotifyWinEvent
SetWindowsHookExW
GetKeyState
GetFocus
GetDlgCtrlID
GetClassInfoW
RegisterClassW
LoadIconW
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
CreateDialogParamW
FindWindowW
LoadImageW
AllowSetForegroundWindow
GetIconInfo
CallNextHookEx
IsWindowEnabled
DrawTextW
SetWindowPos
GetWindowInfo
MonitorFromRect
GetMonitorInfoW
SetScrollInfo
GetScrollInfo
ScrollWindow
SendDlgItemMessageW
GetActiveWindow
GetNextDlgTabItem
UnhookWindowsHookEx
FillRect
InvalidateRect
RegisterWindowMessageW
KillTimer
SetTimer
EnumDisplayDevicesW
EnumDisplaySettingsW
UnregisterDeviceNotification

msvcrt

exit
??3@YAXPAX@Z
??_V@YAXPAX@Z
memset
??_U@YAPAXI@Z
_vsnwprintf
??2@YAPAXI@Z
_ftol2_sse
ceil
memmove_s
_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_errno
realloc
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
_XcptFilter
_ismbblead
_exit
_cexit
__getmainargs
_ftol2
_purecall
__RTDynamicCast
memcpy
__CxxFrameHandler3
wcstok
wcstol
wcscspn
_wcsicmp
free

oleaut32

SysAllocString
SysFreeString
SafeArrayGetElement
VariantInit
VariantClear

powrprof

PowerReadDCValue
PowerSettingAccessCheck
GetPwrCapabilities
PowerDeterminePlatformRole
PowerReadFriendlyName
PowerGetActiveScheme
PowerSetActiveScheme

batmeter

CleanupBatteryData
QueryBatteryData
SetBatteryLevel
BatMeterOnDeviceChange
CreateBatteryData
SubscribeBatteryUpdateNotification
UnsubscribeBatteryUpdateNotification
UpdateBatteryDataAsync
GetBatteryStatusText

winmm

waveOutGetNumDevs
PlaySoundW

shell32

ord100
ord155
ShellExecuteExW
SHGetKnownFolderIDList
DuplicateIcon
ShellExecuteW

shlwapi

wnsprintfW
PathFileExistsW
StrTrimW
PathRemoveBlanksW
PathGetArgsW
ord618
ord437
ord219

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromString
CoInitializeSecurity
CreateStreamOnHGlobal

slc

SLGetWindowsInformationDWORD

rpcrt4

UuidFromStringW

gdiplus

GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageRotateFlip
GdipCreateBitmapFromStream
GdiplusStartup
GdipCreateLineBrush
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipCreateFromHDC
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateBitmapFromStreamICM
GdipCreateSolidFill
GdipFillPath
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLine
GdipFillRectangle
GdipCloneImage

uxtheme

GetThemeColor
OpenThemeData
DrawThemeBackground
BufferedPaintUnInit
GetThemePartSize
GetThemeBackgroundContentRect
GetThemeTextExtent
DrawThemeText
DrawThemeTextEx
BeginBufferedPaint
BufferedPaintSetAlpha
EndBufferedPaint
BufferedPaintInit
CloseThemeData

wlanapi

WlanFreeMemory
WlanOpenHandle
WlanRegisterNotification
WlanSetInterface
WlanCloseHandle
WlanQueryInterface
WlanEnumInterfaces
WlanGetInterfaceCapability

wmi

WmiCloseBlock
WmiExecuteMethodW
WmiOpenBlock
WmiQuerySingleInstanceW
WmiNotificationRegistrationW
WmiQueryAllDataW

comctl32

ImageList_Create
ord345
ord344
ImageList_Destroy
ImageList_DrawIndirect
ImageList_ReplaceIcon

d3d9

Direct3DCreate9Ex

dwmapi

DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

Sections

.pexe
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 794KB - Virtual size: 793KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3a378dd5879a3ea3c69b22cebe1e3fa0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

oleaut32

powrprof

batmeter

winmm

shell32

shlwapi

ole32

slc

rpcrt4

gdiplus

uxtheme

wlanapi

wmi

comctl32

d3d9

dwmapi

wtsapi32

Sections

.pexe Size: 8KB - Virtual size: 7KB

.text Size: 103KB - Virtual size: 103KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 794KB - Virtual size: 793KB

.reloc Size: 6KB - Virtual size: 6KB

.UPX0 Size: 108KB - Virtual size: 260KB

.pexe
Size: 8KB - Virtual size: 7KB

.text
Size: 103KB - Virtual size: 103KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 794KB - Virtual size: 793KB

.reloc
Size: 6KB - Virtual size: 6KB

.UPX0
Size: 108KB - Virtual size: 260KB