4cf093ce40c1011fb0f17ee278252a55f0c38964eece8e145c980c588219a748

Sharing

Copy URL

Twitter E-mail

General

Target

4cf093ce40c1011fb0f17ee278252a55f0c38964eece8e145c980c588219a748
Size

134KB
MD5

48b46cbd8997030717650007c3e72e00
SHA1

6762201b6e5af3bc2905fdc23efcc3a453de421e
SHA256

4cf093ce40c1011fb0f17ee278252a55f0c38964eece8e145c980c588219a748
SHA512

59a310a210a14bc6f6452cdc12e74fbbb66960e57393e456d5ad9c2308482883735a8cbe9b1f532ee2092128b5df0a53e46393653d8ded0a3701210dba4e719b
SSDEEP

3072:UfNLCinH7ooT0Xv++hsnsNWseDuTxngwUY:mHEoIwnsNjeDER

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

4cf093ce40c1011fb0f17ee278252a55f0c38964eece8e145c980c588219a748
.exe windows x86

641768fec1879976ca13acf338103f87

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hcreg8

?GetCompanyName@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
hcreg_SetErrorHandler
?GetProgramName@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
_DoHtmlHelp
?GetProductName@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetPMPDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
SetAppKey
?GetPlotStylesDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetLogFileDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetDriverDirectory@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ

plotcfg8

?SPMP@@YAPAVHT_SPMem_Pool@@XZ

plcfmgr

??0HT_Plot_Config_Manager@@QAE@AAVHT_String@@00V?$HT_Smart_Pointer@VHT_Error_Handler@@@@K@Z
?load_pc3@HT_Plot_Config_Manager@@QAE?AV?$HT_Smart_Pointer@VHT_Plot_Config@@@@VHT_String@@_N@Z
?load_pc3@HT_Plot_Config_Manager@@QAE?AW4Enum@HT_Config_Return@@PBD0@Z
?delete_path@HT_Plot_Config_Manager@@QAE_NPBD@Z
?get_property_from_pm@HT_Plot_Config_Manager@@QAE_NPBD0AA_N@Z
?get_property_from_pm@HT_Plot_Config_Manager@@QAE_NPBD0AAJ@Z

heidi8

??1HT_String@@UAE@XZ
??3HT_String@@SAXPAX@Z
??0HT_String@@QAE@PBD@Z
?copy@HT_String@@QAEXPBD@Z
?concatenate@HT_String@@QAEXPBD@Z
??2HT_Object@@SAPAXI@Z
??3HT_Object@@SAXPAX@Z
??0HT_String@@QAE@ABV0@@Z
?copy@HT_String@@QAEXABV1@@Z

pc3edit

SavePC3
EndPC3Dialog
PC3EditEx

apperr

HD_Create_App_Error_Handler

userdata

?InstallUserData@@YGIXZ

adui16

??1CERutil@@UAE@XZ
??0CERutil@@QAE@XZ
?setTheCERutil@CERutil@@SA_NPAV1@@Z
?makeBuildVersion@CERutil@@UAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HHHH@Z
?makeRegistryVersion@CERutil@@UAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z
?getVersionNumber@CERutil@@UAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PADAAH111@Z
?getInstalledProductKey@CERutil@@UBE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?getInstalledProductName@CERutil@@UBE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ

mfc70

ord1097
ord4996
ord2232
ord2356
ord2546
ord2648
ord4088
ord2529
ord2359
ord2463
ord2352
ord3522
ord3523
ord3513
ord2461
ord3751
ord3452
ord4929
ord4058
ord4944
ord2094
ord1765
ord4977
ord2432
ord4790
ord4793
ord4046
ord3747
ord576
ord4090
ord3917
ord2747
ord4685
ord2021
ord1178
ord832
ord5126
ord2800
ord2254
ord2253
ord3819
ord1409
ord341
ord3271
ord1077
ord257
ord705
ord977
ord1081
ord5669
ord1472
ord1469
ord4267
ord1273
ord4025
ord1760
ord4854
ord5989
ord3966
ord3208
ord4503
ord1452
ord5714
ord812
ord817
ord821
ord819
ord823
ord2239
ord2223
ord2242
ord2237
ord2214
ord2216
ord2234
ord2026
ord2675
ord2020
ord1377
ord5993
ord3610
ord5991
ord3152
ord4748
ord1234
ord1814
ord1508
ord1507
ord1451
ord4972
ord703
ord534
ord280
ord2651
ord4262
ord4042
ord957
ord256
ord1051
ord982
ord493
ord3832
ord3487
ord698
ord3814
ord4998
ord4349
ord5322
ord2096
ord5992
ord3609
ord5990
ord4107
ord1913
ord1868
ord5339
ord3614
ord4997
ord4900
ord899
ord4883
ord848
ord5933
ord5152
ord3640
ord512
ord3140
ord1014
ord947
ord1770
ord2741
ord2244
ord3750
ord5002
ord4985
ord663
ord5208
ord5472
ord476
ord956
ord2201
ord3449
ord4045
ord4263
ord4347
ord2431
ord2438
ord5952
ord1866
ord1901
ord557
ord4935
ord5348
ord1251
ord5178
ord2555
ord5255
ord4038
ord4633
ord4520
ord4486
ord1772
ord4003
ord2848
ord2581
ord5688
ord5791
ord314
ord3255
ord3486
ord4932
ord4953
ord4054
ord3151
ord1233
ord697
ord4225
ord4224
ord4571
ord3985
ord4562
ord4761
ord3953
ord3962
ord4372
ord4558
ord4167
ord4182
ord4180
ord4162
ord4165
ord4160
ord4645
ord4642
ord3776
ord511
ord3395
ord3748
ord4986
ord4063
ord5007
ord5005
ord2219
ord2229
ord2227
ord2225
ord2221

msvcr70

_setmbcp
_CxxThrowException
_purecall
vsprintf
memmove
strtok
_getcwd
_vscprintf
_splitpath
__CxxFrameHandler
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

kernel32

WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetModuleHandleA
lstrcpyA
LocalFree
LockResource
LoadLibraryA
FindClose
GlobalGetAtomNameA
GetLastError
SizeofResource
FormatMessageA
GlobalAddAtomA
LoadResource
FreeLibrary
FindResourceA
GlobalDeleteAtom
GetVersionExA
FindFirstFileA

user32

PostMessageA
FindWindowA
RegisterWindowMessageA
LoadCursorA
DefWindowProcA
UpdateWindow
LoadIconA
PostQuitMessage
UnregisterClassA
EnableWindow

winspool.drv

EnumPrintersA

Exports

Exports

??1HT_Media_Info@@UAE@XZ
??1HT_Media_Names@@UAE@XZ
??1HT_PC3_Data@@UAE@XZ
??1HT_Plot_Config@@UAE@XZ
??1HT_Plot_Style@@UAE@XZ
??1HT_Style_Sheet_Configuration@@UAE@XZ
??1HT_Thin_Plot_Config_Manager@@UAE@XZ
??1PCM_Class_Factory@@UAE@XZ
?get_driver_search_path@HT_Plot_Config_Manager@@QAE?AVHT_String@@XZ
?get_style_sheet_search_path@HT_Plot_Config_Manager@@QAE?AVHT_String@@XZ
?get_udm_search_path@HT_Plot_Config_Manager@@QAE?AVHT_String@@XZ
?set_driver_search_path@HT_Plot_Config_Manager@@QAEXVHT_String@@@Z
?set_style_sheet_search_path@HT_Plot_Config_Manager@@QAEXVHT_String@@@Z
?set_udm_search_path@HT_Plot_Config_Manager@@QAEXVHT_String@@@Z

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX
Size: 72KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

641768fec1879976ca13acf338103f87

Headers

File Characteristics

Imports

hcreg8

plotcfg8

plcfmgr

heidi8

pc3edit

apperr

userdata

adui16

mfc70

msvcr70

kernel32

user32

winspool.drv

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 35KB - Virtual size: 35KB

.UPX Size: 72KB - Virtual size: 76KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 35KB - Virtual size: 35KB

.UPX
Size: 72KB - Virtual size: 76KB