431e450dcd609c75a415171d795611ae44cc337c4d2fbb34a944837c25beef1b

Sharing

Copy URL

Twitter E-mail

General

Target

431e450dcd609c75a415171d795611ae44cc337c4d2fbb34a944837c25beef1b
Size

58KB
MD5

505f68d6e8fb2706d6b1ebc6c80c798b
SHA1

bd23b9ccc44c0e1109b467561fcadb3a1434bcab
SHA256

431e450dcd609c75a415171d795611ae44cc337c4d2fbb34a944837c25beef1b
SHA512

766c68e0450ff3a5223988a5c1f11bb4754abd76c89ee0e62e47bec5ffa05c49ae5d84a01735c97599d14d80d0b05d124a0bc685b859f6d125f986e796aaca8e
SSDEEP

1536:xMhmdkLTcG592/Ccvcd2pjJuNmxM3Y/lM:xUokLTcGr2/CcNpj3xM3YlM

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

431e450dcd609c75a415171d795611ae44cc337c4d2fbb34a944837c25beef1b
.exe windows x86

27eac643b5cdc8a66d5c497b14ba29e1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
QueryPerformanceCounter
InitializeCriticalSection
SetErrorMode
GetLastError
RemoveDirectoryW
GetVolumeInformationW
LoadLibraryW
FreeLibrary
Sleep
CreateDirectoryW
CreateMutexA
VirtualAllocEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

RegOpenKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

loadperf

UpdatePerfNameFilesW
UnloadPerfCounterTextStringsA

user32

SetWindowTextW
LoadImageA
LoadMenuW
DialogBoxIndirectParamA
CopyRect
PostQuitMessage
GetMenuItemInfoW
ActivateKeyboardLayout
LoadImageW
ShowCursor
LoadMenuIndirectA
MonitorFromRect
EnumClipboardFormats
SetCursorPos
InvalidateRect
RegisterClassA
WaitMessage
PeekMessageW
GetScrollPos
OffsetRect
DialogBoxIndirectParamW
GetDlgItemTextW
EnableWindow

colbact

DllRegisterServer

Sections

UPX0
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.C
Size: 1024B - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pMTqU
Size: 4KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Dnhw
Size: 2KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 10KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.KjNq
Size: 2KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27eac643b5cdc8a66d5c497b14ba29e1

Headers

File Characteristics

Imports

kernel32

version

advapi32

loadperf

user32

colbact

Sections

UPX0 Size: 5KB - Virtual size: 5KB

.text Size: 12KB - Virtual size: 11KB

.C Size: 1024B - Virtual size: 80KB

.pMTqU Size: 4KB - Virtual size: 62KB

.rdata Size: 2KB - Virtual size: 12KB

.Dnhw Size: 2KB - Virtual size: 296KB

.edata Size: 10KB - Virtual size: 59KB

.KjNq Size: 2KB - Virtual size: 318KB

.data Size: 6KB - Virtual size: 290KB

.edata Size: 10KB - Virtual size: 41KB

.rsrc Size: 2KB - Virtual size: 1KB

UPX0
Size: 5KB - Virtual size: 5KB

.text
Size: 12KB - Virtual size: 11KB

.C
Size: 1024B - Virtual size: 80KB

.pMTqU
Size: 4KB - Virtual size: 62KB

.rdata
Size: 2KB - Virtual size: 12KB

.Dnhw
Size: 2KB - Virtual size: 296KB

.edata
Size: 10KB - Virtual size: 59KB

.KjNq
Size: 2KB - Virtual size: 318KB

.data
Size: 6KB - Virtual size: 290KB

.edata
Size: 10KB - Virtual size: 41KB

.rsrc
Size: 2KB - Virtual size: 1KB