54dea94b55fb0fce8057b9b6dad3909ec08e67d5bc167e91be6d5577c14e7049

Sharing

Copy URL Twitter E-mail

General

Target

54dea94b55fb0fce8057b9b6dad3909ec08e67d5bc167e91be6d5577c14e7049
Size

452KB
MD5

0b9424c9735375ca29bb405455f2c7d3
SHA1

5cbf4c81d40cd60c362ed01287b4ba3d8e466420
SHA256

54dea94b55fb0fce8057b9b6dad3909ec08e67d5bc167e91be6d5577c14e7049
SHA512

5248b417176f81136052ccaee20841a8cccf00133df4767385c2a5b5789d2f6390d1948347e808bc185c5d0183fc362833541bca6deff2bcccaaa0ac7ee931d7
SSDEEP

12288:aCBvQNPRnrNC8Z2UySFunbXIoIpEFNM1:bRQNPHCQ2GMbXItE7G

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

54dea94b55fb0fce8057b9b6dad3909ec08e67d5bc167e91be6d5577c14e7049
.exe windows x86

805b31615d80e55f3609722ebaf2e3d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
QueryServiceStatus
LookupAccountSidA
PrivilegeCheck
GetSecurityDescriptorLength
IsValidSecurityDescriptor
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
MakeAbsoluteSD
SetSecurityDescriptorDacl
MakeSelfRelativeSD
GetLengthSid
InitializeAcl
AddAccessAllowedAce
AddAccessDeniedAce
GetAce
GetUserNameA
AllocateAndInitializeSid
GetSidLengthRequired
CopySid
FreeSid
LookupAccountNameA
LookupAccountSidW
IsValidSid
EqualSid
RegConnectRegistryA
RegSetKeySecurity
RegCreateKeyA
DuplicateToken
RegOpenKeyA
RegQueryValueExA
RegEnumValueA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
CreateServiceA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
DeleteService
RegEnumKeyExA
OpenThreadToken
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetThreadToken
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyA

kernel32

HeapCreate
DuplicateHandle
MapViewOfFile
CreateFileMappingA
GetExitCodeProcess
CreateProcessW
GetStartupInfoA
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetOEMCP
GetCPInfo
HeapSize
VirtualAlloc
ExitProcess
RtlUnwind
HeapReAlloc
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
TlsSetValue
TlsGetValue
IsBadWritePtr
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
SetEndOfFile
lstrcpyA
HeapDestroy
GetCurrentThreadId
InterlockedIncrement
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
CloseHandle
RaiseException
WaitForSingleObject
GetLastError
CreateEventA
SetEvent
OpenEventA
TerminateThread
CreateThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
GetComputerNameA
WideCharToMultiByte
lstrlenW
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetProcessHeap
lstrcmpiA
UnmapViewOfFile
lstrcatA
LocalFree
FormatMessageA
GetFileAttributesA
GetCurrentThread
lstrcpynA
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
SetUnhandledExceptionFilter
GetCommandLineA
GetCurrentProcessId
SetErrorMode
GetPrivateProfileStringA
OpenProcess
TerminateProcess
GetProcessTimes
CreateDirectoryA
GetProfileStringA
WritePrivateProfileStringA
WriteProfileStringA
GetPrivateProfileSectionNamesA
ResumeThread
HeapFree
LocalAlloc
GetVersion
GetTickCount
CreateProcessA
LockResource
SetEnvironmentVariableA
GetSystemDirectoryA
ReleaseMutex
CreateMutexA
GetModuleHandleW
FindClose
FindFirstFileA
LocalSize
ReadFile
SetFilePointer
CreateFileA
SetLastError
ReadProcessMemory
FindResourceExA
CompareStringA
CompareStringW
TlsAlloc

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoDisconnectObject
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstanceEx
CoRegisterClassObject
CoSetProxyBlanket
CoQueryProxyBlanket
CLSIDFromString
StringFromCLSID
StringFromIID
IIDFromString
CoGetClassObject
CoGetCallContext
CoRevokeClassObject
CoRevertToSelf
CoCreateGuid
CoImpersonateClient
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayCreate

rpcrt4

RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
NdrClientCall
RpcBindingSetAuthInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA

shlwapi

PathFindExtensionA

user32

UnregisterClassA
wsprintfW
CharUpperA
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
SetForegroundWindow
EndDialog
EnableWindow
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
IsDlgButtonChecked
PostThreadMessageA
KillTimer
GetMessageA
SetTimer
PeekMessageA
SetWindowLongA
CharNextA
MessageBoxA
LoadStringA
DialogBoxParamA
DispatchMessageA
RegisterWindowMessageA
wsprintfA
GetWindowLongA
SendMessageA
CheckDlgButton
GetDlgItemInt
GetDlgItemTextA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

805b31615d80e55f3609722ebaf2e3d9

Headers

File Characteristics

Imports

advapi32

kernel32

ole32

oleaut32

rpcrt4

shell32

shlwapi

user32

version

Sections

.text Size: 276KB - Virtual size: 275KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 16KB - Virtual size: 12KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 276KB - Virtual size: 275KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 16KB - Virtual size: 12KB

UPX0
Size: 144KB - Virtual size: 380KB