7fc1fa28dcb91f9090a6323f9cc4132cb1d1b1e837434dbe7ee88f29fbccfb19

Sharing

Copy URL Twitter E-mail

General

Target

7fc1fa28dcb91f9090a6323f9cc4132cb1d1b1e837434dbe7ee88f29fbccfb19
Size

2.1MB
MD5

c1eed0adf82904d40541e093bafbf73f
SHA1

fede1de4bca6c2084ee330d234be89b80ee4378c
SHA256

7fc1fa28dcb91f9090a6323f9cc4132cb1d1b1e837434dbe7ee88f29fbccfb19
SHA512

bc1f7f11b5f187563fbfcffac4e6f0970bbde18443894997304a6795a678a839c733f9309155fb9203ab1ac263573d3ee61e7589b386480bd2d7d86e1fc40421
SSDEEP

49152:3mXtsfcrU0Y9zJY7tEbKXK+nsdMdQX1rBR4:3AE5+5wKXKNdMCL4

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

7fc1fa28dcb91f9090a6323f9cc4132cb1d1b1e837434dbe7ee88f29fbccfb19
.exe windows x86

1f07dbb42b10b66fb8634865565f312d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
WaitForSingleObject
SetEvent
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetLocalTime
LoadLibraryW
CloseHandle
GetLastError
ResetEvent
GetCurrentDirectoryW
ExitProcess
AssignProcessToJobObject
GetCurrentProcess
SetInformationJobObject
CreateJobObjectW
HeapSetInformation
LocalFree
LocalAlloc
GetSystemTimeAsFileTime
WaitForMultipleObjects
CreateThread
DeleteTimerQueueEx
CreateTimerQueue
LocalFileTimeToFileTime
TryEnterCriticalSection
FlushViewOfFile
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
LoadLibraryA
HeapAlloc
IsDebuggerPresent
GetSystemDirectoryW
SetLastError
FlushFileBuffers
FormatMessageW
CreateTimerQueueTimer
QueueUserWorkItem
DeleteTimerQueueTimer
TlsAlloc
ChangeTimerQueueTimer
TlsSetValue
TlsGetValue
GetTimeZoneInformation
ReleaseSemaphore
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
GetDiskFreeSpaceExW
CreateEventW
VerifyVersionInfoW
GetProductInfo
InterlockedCompareExchange64
PostQueuedCompletionStatus
HeapFree
DeleteCriticalSection
CreateIoCompletionPort
QueryPerformanceFrequency
GetQueuedCompletionStatus
SetEndOfFile
FindNextFileW
FileTimeToLocalFileTime
MoveFileW
SetFileAttributesW
SetFilePointer
RaiseException
BackupWrite
BackupSeek
BackupRead
GetExitCodeThread
FindFirstFileW
FindClose
GetFileInformationByHandle
DeviceIoControl
CancelIo
VirtualFree
GetOverlappedResult
CreateFileW
VirtualAlloc
SetFilePointerEx
SystemTimeToFileTime
GetVersionExW
MoveFileExW
WriteFile
GetFileSizeEx
ReadFile
MultiByteToWideChar
GetComputerNameExW
GetComputerNameW
GetCurrentThread
lstrlenW
ExpandEnvironmentStringsW
FileTimeToSystemTime
GetSystemTime
CreateDirectoryW
DeleteFileW
GetFileAttributesW
FindFirstVolumeW
FindVolumeMountPointClose
FindNextVolumeW
FindVolumeClose
GetVolumeNameForVolumeMountPointW
GetDriveTypeW
GetVolumeInformationW
GetVolumePathNameW
GetVolumePathNamesForVolumeNameW
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedCompareExchange
InterlockedExchange
Sleep
WideCharToMultiByte
GetProcessHeap
InitializeCriticalSection

msvcrt

_purecall
__CxxFrameHandler3
memcpy_s
memmove_s
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0bad_cast@@QAE@ABV0@@Z
fopen
_fdopen
fprintf
ftell
strcpy_s
fread
ferror
_ui64tow
wcsrchr
iswspace
towupper
_controlfp
_onexit
_lock
__dllonexit
_unlock
__uncaught_exception
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
islower
isupper
__pctype_func
__crtLCMapStringA
abort
__iob_func
fclose
fsetpos
fseek
fgetpos
fwrite
setvbuf
fflush
ungetc
fputc
fgetc
setlocale
___lc_handle_func
___lc_codepage_func
_errno
malloc
_callnewh
free
wcsncmp
_wcsicmp
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
sprintf_s
strcspn
??0exception@@QAE@XZ
memchr
localeconv
memset
memcpy
?set_terminate@@YAP6AXXZP6AXXZ@Z
??1bad_cast@@UAE@XZ
_CxxThrowException
_wcsnicmp
wcschr
towlower
wcscspn
swscanf
_vsnwprintf
_wcsupr
wcsstr
_wtoi
_wtoi64
_wcslwr
__RTDynamicCast
mbtowc
__mb_cur_max
wcstok
_itow
_ftol2
_vsnprintf
iswdigit
memmove
rand
strrchr
wcsspn

ntdll

RtlAdjustPrivilege
NtOpenProcessToken
RtlFreeUnicodeString
RtlCreateSystemVolumeInformationFolder
NtQueryVolumeInformationFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtQueryDirectoryFile
NtQueryInformationFile
NtOpenFile
NtCreateFile
RtlGetFullPathName_U
RtlDosPathNameToNtPathName_U
NtFsControlFile
RtlInitUnicodeStringEx
NtQuerySecurityObject
RtlUpcaseUnicodeChar
RtlFreeHeap
VerSetConditionMask
RtlInitUnicodeString
RtlAllocateHeap
RtlAssert
NtClose
NtAdjustPrivilegesToken
NtOpenThreadToken
RtlNtStatusToDosError

framedynos

?GetDMTF@WBEMTime@@QBEPAGH@Z
??4WBEMTime@@QAEABV0@ABU_FILETIME@@@Z
?GetFILETIME@WBEMTime@@QBEHPAU_FILETIME@@@Z
?SetDMTF@WBEMTime@@QAEHQAG@Z
?GetSYSTEMTIME@WBEMTime@@QBEHPAU_SYSTEMTIME@@@Z
??4WBEMTime@@QAEABV0@ABU_SYSTEMTIME@@@Z
??4WBEMTime@@QAEABV0@QAG@Z

crypt32

CertFreeCertificateContext

shell32

SHGetFolderPathAndSubDirW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 30KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 112KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1f07dbb42b10b66fb8634865565f312d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

framedynos

crypt32

shell32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.data Size: 30KB - Virtual size: 37KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 89KB - Virtual size: 88KB

UPX0 Size: 112KB - Virtual size: 264KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 30KB - Virtual size: 37KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 89KB - Virtual size: 88KB

UPX0
Size: 112KB - Virtual size: 264KB