7a3e7a761e87c379ed3c4027915a1e9e1154ec890198714f5865b16024ea7d2b

Sharing

Copy URL Twitter E-mail

General

Target

7a3e7a761e87c379ed3c4027915a1e9e1154ec890198714f5865b16024ea7d2b
Size

270KB
MD5

241bd6ea1c40047e4dbda90f1c059103
SHA1

5672987f2c910f2d0cf2bc8531160dd68a135271
SHA256

7a3e7a761e87c379ed3c4027915a1e9e1154ec890198714f5865b16024ea7d2b
SHA512

ce45879bcd748adeb7a147c3921e9335e5c03e5e4f6c3713afea16605f2f5a52710132ab06cef5e5f1c844a37d41420b458ac5c62375fe73518efb9a8eb2b5b3
SSDEEP

6144:1s+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:uHMwm9AHebVKkdrH5eyr

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

7a3e7a761e87c379ed3c4027915a1e9e1154ec890198714f5865b16024ea7d2b
.exe windows x86

eacb494804cde55e7b0984642cfbc00b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
LoadLibraryW
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
Sleep
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
FreeLibrary
GetModuleHandleW
GetProcAddress

advapi32

OpenProcessToken
GetTokenInformation

msasn1

ASN1BEREncCheck
ASN1BEREncObjectIdentifier
ASN1CEREncMultibyteString
ASN1utf8string_free
ASN1BERDecS32Val
ASN1charstring_cmp
ASN1ztchar16string_free
ASN1BEREncChar32String
ASN1BERDecZeroChar16String
ASN1BEREncFlush
ASN1utctime_cmp
ASN1Free
ASN1uint32_uoctets

feclient

FeClientInitialize

Sections

UPX1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MZyHR
Size: 2KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.OnCt
Size: 5KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.p
Size: 2KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lBfb
Size: 4KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 75KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sRTyB
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 141KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cLqql
Size: 4KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eacb494804cde55e7b0984642cfbc00b

Headers

File Characteristics

Imports

kernel32

advapi32

msasn1

feclient

Sections

UPX1 Size: 9KB - Virtual size: 9KB

.MZyHR Size: 2KB - Virtual size: 198KB

.text Size: 13KB - Virtual size: 13KB

.OnCt Size: 5KB - Virtual size: 318KB

.p Size: 2KB - Virtual size: 231KB

.rdata Size: 1024B - Virtual size: 32KB

.lBfb Size: 4KB - Virtual size: 232KB

.edata Size: 75KB - Virtual size: 102KB

.sRTyB Size: 1024B - Virtual size: 4KB

.data Size: 7KB - Virtual size: 135KB

.edata Size: 141KB - Virtual size: 153KB

.cLqql Size: 4KB - Virtual size: 104KB

.rsrc Size: 2KB - Virtual size: 1KB

UPX1
Size: 9KB - Virtual size: 9KB

.MZyHR
Size: 2KB - Virtual size: 198KB

.text
Size: 13KB - Virtual size: 13KB

.OnCt
Size: 5KB - Virtual size: 318KB

.p
Size: 2KB - Virtual size: 231KB

.rdata
Size: 1024B - Virtual size: 32KB

.lBfb
Size: 4KB - Virtual size: 232KB

.edata
Size: 75KB - Virtual size: 102KB

.sRTyB
Size: 1024B - Virtual size: 4KB

.data
Size: 7KB - Virtual size: 135KB

.edata
Size: 141KB - Virtual size: 153KB

.cLqql
Size: 4KB - Virtual size: 104KB

.rsrc
Size: 2KB - Virtual size: 1KB