af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab

Sharing

Copy URL

Twitter E-mail

General

Target

af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab
Size

250KB
MD5

fb842474b5529980e8fdfa01f647f87a
SHA1

dbecd4ecf444b940b965393b7d03df7e7527da11
SHA256

af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab
SHA512

c7af6bd000bbdce11be7daff650db7d2de7930c852908111cc6a9dd7d5e730d75b860b5b1514efa72d0a008ec3ff04127476b67fdf8688e9774b55d26fed9eaf
SSDEEP

6144:aZ/4UHB0CnKk/T7J6bdULh3VvKsO5GTHYjlzIS:sKk/TCdULxViZ5GrYjlzx

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab
.exe windows x86

ee1f3aa89716293e7f70a15ad6bb3168

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleW
GetProcAddress

user32

GetSystemMetrics
MessageBoxIndirectA
GetMenuItemRect
CreateDialogParamW
CharUpperA
PostQuitMessage
CharNextA
PostMessageA
GetTopWindow
GetIconInfo
EnumWindows
FindWindowW
DialogBoxParamW
SetCursor
SetDlgItemTextW
LoadImageA
CreateAcceleratorTableW
GetMenuStringA
DialogBoxIndirectParamW
wsprintfW
GetSubMenu
RegisterClassW
CopyIcon
SetActiveWindow

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW

usp10

ScriptGetProperties
ScriptFreeCache
ScriptItemize
ScriptTextOut
ScriptString_pcOutChars
ScriptIsComplex
ScriptStringGetLogicalWidths
ScriptApplyDigitSubstitution
UspAllocCache

gdi32

RemoveFontResourceExW
CreateFontA
UpdateICMRegKeyA
CreatePolyPolygonRgn
RemoveFontResourceA
CreateScalableFontResourceW
CreateDIBPatternBrushPt

filemgmt

DllGetClassObject

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 1024B - Virtual size: 434KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 79KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CODE
Size: 512B - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 141KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee1f3aa89716293e7f70a15ad6bb3168

Headers

File Characteristics

Imports

kernel32

user32

advapi32

usp10

gdi32

filemgmt

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 2KB - Virtual size: 11KB

UPX0 Size: 1024B - Virtual size: 434KB

.edata Size: 79KB - Virtual size: 166KB

CODE Size: 512B - Virtual size: 144KB

.data Size: 7KB - Virtual size: 143KB

.edata Size: 141KB - Virtual size: 237KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 2KB - Virtual size: 11KB

UPX0
Size: 1024B - Virtual size: 434KB

.edata
Size: 79KB - Virtual size: 166KB

CODE
Size: 512B - Virtual size: 144KB

.data
Size: 7KB - Virtual size: 143KB

.edata
Size: 141KB - Virtual size: 237KB

.rsrc
Size: 3KB - Virtual size: 3KB