c58d20a8c82d7e417f12411b7a4660d9c89a29db2c7742bac04a86a671762810

Sharing

Copy URL Twitter E-mail

General

Target

c58d20a8c82d7e417f12411b7a4660d9c89a29db2c7742bac04a86a671762810
Size

348KB
MD5

fee7904610afdfec1730dd74a7240997
SHA1

8bf9000348686d4c1620fa6a3cccf49421c4e365
SHA256

c58d20a8c82d7e417f12411b7a4660d9c89a29db2c7742bac04a86a671762810
SHA512

3dfa7b7208120a76a2fdf5e153ec14ad55aabf6dff4106afe65d0ceb0a57e793a620fc183c46a79c60f18c7a6f075d872d08c570e585652255198848493dcf05
SSDEEP

6144:UbAEin9LUVU6PV6c9NxHiALeEWzeWKhLi+TB4bMboz1hzyAX5siO:UbAEin956PlNxHJjW6WKh2GTbgvX

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

c58d20a8c82d7e417f12411b7a4660d9c89a29db2c7742bac04a86a671762810
.dll windows x86

b5f8e9a84c269d37cef4bbc59d9ce29a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
GetTempPathW
DeleteFileW
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemInfo
EnterCriticalSection
CreateThread
ReadFile
ReadConsoleW
SetConsoleMode
GetConsoleMode
GetStdHandle
GetConsoleOutputCP
WriteConsoleW
GetFileType
LocalFree
RaiseException
SetFilePointerEx
MultiByteToWideChar
LocalSize
GetModuleHandleA
SetFileAttributesW
GetCommandLineW
GetThreadLocale
SetEvent
WideCharToMultiByte
ResumeThread
GlobalLock
GlobalUnlock
FreeLibrary
DeleteCriticalSection
GlobalFree
lstrcatW
GetModuleFileNameW
lstrlenW
lstrcpyW
GlobalAlloc
WinExec
GetSystemDirectoryW
GetLastError
LocalAlloc
CloseHandle
GetModuleHandleW
lstrcmpiW
GetCurrentThread
WaitForSingleObject
QueryPerformanceCounter
UnhandledExceptionFilter
Sleep
DeleteFileA
InterlockedExchange
GetProcAddress
DuplicateHandle
WriteFile
LoadLibraryA

user32

BeginPaint
GetClientRect
LoadCursorW
UnhookWindowsHookEx
CallNextHookEx
GetDC
SetWindowPos
GetFocus
KillTimer
SetTimer
wsprintfW
LoadStringW
LoadIconW
LoadBitmapW
EnumThreadWindows
GetSysColor
GetClassNameW
GetParent
WinHelpW
GetDlgCtrlID
IsWindow
IsWindowVisible
EnableWindow
wsprintfA
IsWindowEnabled
AnyPopup
CreateWindowExW
GetWindowLongW
GetWindowRect
ReleaseDC
EndPaint
DefWindowProcW
CallWindowProcW
SystemParametersInfoW
SetFocus
GetKeyState
DestroyWindow
SetWindowsHookExW

ole32

CreateStreamOnHGlobal
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc

oleaut32

SysFreeString
SysStringLen
SysAllocString

msvcrt

iswspace
fputwc
fwprintf
vfwprintf
wcscmp
towupper
fclose
exit
getc
printf
qsort
wcscpy
wcslen
malloc
realloc
free
fread
perror
swscanf
wprintf
wcscat
iswdigit
wcsstr

secur32

InitializeSecurityContextW
AcceptSecurityContext

comctl32

CreatePropertySheetPageW

urlmon

URLDownloadToFileW

ws2_32

ioctlsocket
ntohl
htonl
WSAGetLastError
WSACleanup

Exports

Exports

Bitcoin
ComputersAroundStart
CybercriminalTriesSo
DeterminationEarlier
DigitalAt
ExistingProgramsSometimes
FightVeryQuarter
ForUsers
HighintensityWhich
LawCERTs
OurRapidEveryone
PreventedStreamline
Provide
Providing
ReachForms

Sections

.text
Size: 268KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UPX0
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5f8e9a84c269d37cef4bbc59d9ce29a

Headers

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

msvcrt

secur32

comctl32

urlmon

ws2_32

Exports

Exports

Sections

.text Size: 268KB - Virtual size: 265KB

UPX0 Size: 4KB - Virtual size: 2KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 32KB - Virtual size: 32KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 268KB - Virtual size: 265KB

UPX0
Size: 4KB - Virtual size: 2KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 32KB - Virtual size: 32KB

.reloc
Size: 4KB - Virtual size: 1KB