f141a6313484c3ca51d36d04c2a76f14b69974c4eaf3813e3001be1bf4b41936

Sharing

Copy URL Twitter E-mail

General

Target

f141a6313484c3ca51d36d04c2a76f14b69974c4eaf3813e3001be1bf4b41936
Size

192KB
MD5

525cad5c02901c22277fea2b6c2ceb50
SHA1

684caa89c7afc12c51d2938199150fa9a2b00900
SHA256

f141a6313484c3ca51d36d04c2a76f14b69974c4eaf3813e3001be1bf4b41936
SHA512

839cc963c3ffd76d18dddd94af2995b734338c186b9d05e0dd84f88fbb7f128c6e671217d8a16913c0951c1c49f7565db2f9975a039bc8b4e093d3be756326d5
SSDEEP

3072:25bcT8ULRWgZYS8YQEBgeJmTjRGfj/e7fWxrRiceJUrDcny/m39Vd7:4bg1Y3KQESImIfze7+FteJ2/ML7

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

f141a6313484c3ca51d36d04c2a76f14b69974c4eaf3813e3001be1bf4b41936
.exe windows x86

67cbad80770a6a6cb9cdbaa0599d2663

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
RegDeleteKeyValueW
RegGetValueW
RegSetKeyValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
EventWrite

kernel32

GlobalAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
GetComputerNameExW
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
ResetEvent
SubmitThreadpoolWork
CreateThreadpoolWork
GlobalFree
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
WaitForSingleObject
GetCurrentProcess
CreateFileW
InterlockedIncrement
InterlockedDecrement
SetEvent
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
DuplicateHandle
GetTickCount
CreateEventW
CreateThreadpoolTimer
GetLastError
InterlockedExchange
MultiByteToWideChar
GetSystemFirmwareTable
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
Sleep
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange

user32

GetDisplayConfigBufferSizes
DisplayConfigGetDeviceInfo
QueryDisplayConfig

msvcrt

__set_app_type
free
_purecall
malloc
memset
qsort
_wcsnicmp
wcsstr
_wcsicmp
_vsnwprintf
__RTDynamicCast
wcschr
memcpy
_callnewh
__getmainargs
_cexit
_controlfp
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_ismbblead
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_XcptFilter
_exit

ole32

CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize
CLSIDFromString
IIDFromString
StringFromIID
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject

devobj

DevObjGetDeviceProperty
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList

propsys

PSPropertyKeyFromString

dmrc

DMrcQueryModelId
DMrcGetProperties
DMrcQueryClose
DMrcInit
DMrcExit
DMrcQueryHardwareId

xmllite

CreateXmlReader

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptGetProperty
BCryptCreateHash
BCryptHashData

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67cbad80770a6a6cb9cdbaa0599d2663

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

devobj

propsys

dmrc

xmllite

bcrypt

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.UPX0
Size: 108KB - Virtual size: 260KB