9ed27f01112b40e6641a9b26b81b4f0d28bf09d8e81affc25775a67ff701ebab

Sharing

Copy URL Twitter E-mail

General

Target

9ed27f01112b40e6641a9b26b81b4f0d28bf09d8e81affc25775a67ff701ebab
Size

199KB
MD5

38e2dc5db2638d966fc4bba5f82c6f2b
SHA1

587d5d9eb7eddb83f62a4bda3189d5977533b2b1
SHA256

9ed27f01112b40e6641a9b26b81b4f0d28bf09d8e81affc25775a67ff701ebab
SHA512

c60bfb1af1c05be1215dfea75a93a8d39370f6081fbfe0e7883fa40cc2b93cbf5063593ca214864ad7e11d68a07012aa73b13d2cd2ff7582c5895fa2c013c0b3
SSDEEP

3072:OtmSPwRDGm9Mq3oL/ZgJqD4vneu6BYSf5hZ/Szs034G+:OteGmaq3IxgJqVrBY2gj

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

9ed27f01112b40e6641a9b26b81b4f0d28bf09d8e81affc25775a67ff701ebab
.exe windows x86

43790a112a6a896a49a89700d9492f9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
printf
puts
??2@YAPAXI@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
_ultoa
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z

kernel32

ReadFile
DisconnectNamedPipe
RaiseException
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
WaitForMultipleObjects
OpenProcess
DuplicateHandle
CreateFileA
SetThreadPriority
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
DeviceIoControl
GetOverlappedResult
CreateThread
ResumeThread
PulseEvent
GetCurrentThreadId
GetProcessHeap
HeapAlloc
lstrcpyA
OpenEventA
lstrcmpiA
FormatMessageA
LocalAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
GetLastError
lstrlenA
Sleep
CloseHandle
WaitForSingleObject
CreateEventA
ExpandEnvironmentStringsA
GetModuleFileNameA
GetModuleHandleA
WriteFile
LocalFree
ConnectNamedPipe
CreateNamedPipeA
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrlenW
GetCurrentProcess
SetLastError

ntdll

strpbrk
sprintf
_strnicmp
isgraph
_itoa

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

43790a112a6a896a49a89700d9492f9b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

ntdll

Sections

.text Size: 71KB - Virtual size: 70KB

.data Size: 512B - Virtual size: 504B

.rsrc Size: 18KB - Virtual size: 18KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 71KB - Virtual size: 70KB

.data
Size: 512B - Virtual size: 504B

.rsrc
Size: 18KB - Virtual size: 18KB

.UPX0
Size: 108KB - Virtual size: 260KB