92e115375e38fc376790f88de3552521d0ea3938828406a04001f2b8a22e5cee

Sharing

Copy URL Twitter E-mail

General

Target

92e115375e38fc376790f88de3552521d0ea3938828406a04001f2b8a22e5cee
Size

620KB
MD5

346da9cfb573a71b41ad4bebf5574842
SHA1

fa682a27efa7793648a8d79b593f7c5408b1075b
SHA256

92e115375e38fc376790f88de3552521d0ea3938828406a04001f2b8a22e5cee
SHA512

37d16f81f15f3de32ddba63d8f41e7ad165659adf34715fcf96dd7546722e246a69931b32ff0d107f5d8ed9c80c26be822a7ba42af3ec53ec84336600e9fce45
SSDEEP

12288:WLvTwCXi8lwtNCFY5hH1Ygm/Ll4Wl+eIO9CVRiMi7bRy5GvWEr/:WkhOgyl4CAACVRRi7bRYGvJb

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

92e115375e38fc376790f88de3552521d0ea3938828406a04001f2b8a22e5cee
.exe windows x86

ab7028c689eda741357257b2e53cc729

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipCloneBrush
GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromScan0
GdipFillEllipseI
GdipCreatePen1
GdipDrawEllipseI
GdipDeletePen
GdipDeleteBrush
GdipGetImageHeight
GdipGetImageWidth
GdiplusStartup
GdipCloneImage
GdipAlloc
GdiplusShutdown
GdipFree
GdipLoadImageFromStream
GdipCreateFromHDC
GdipCreateImageAttributes
GdipSetImageAttributesRemapTable
GdipDrawImageRectRectI
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageType
GdipDrawImageRectI

kernel32

lstrcatA
GetPrivateProfileStringA
lstrcpyA
lstrlenA
LocalAlloc
SetEnvironmentVariableA
CreateThread
GetDriveTypeA
LoadLibraryA
SetErrorMode
FreeLibrary
VirtualAlloc
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CompareStringA
SetEndOfFile
SetFilePointer
CopyFileA
WriteFile
lstrcmpiA
ReadFile
GetFileSize
lstrcpynA
GetModuleFileNameA
DeleteFileA
GetWindowsDirectoryA
QueryPerformanceFrequency
CreateEventA
GetTickCount
GetCurrentThreadId
GetFileAttributesA
IsDBCSLeadByte
FindClose
lstrcmpA
FindFirstFileA
GetProcAddress
GetModuleHandleA
CreateDirectoryA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
LockResource
LoadResource
FindResourceA
GetUserDefaultLCID
GetCurrentDirectoryA
SetCurrentDirectoryA
GetEnvironmentVariableA
VerLanguageNameA
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
SetLastError
GetLastError
Sleep
GlobalSize
SizeofResource
GetSystemDirectoryA
GetSystemInfo
GetVersion
GetLocalTime
GetCurrentProcess
WritePrivateProfileStringA
FindResourceExA
CreateProcessA
InterlockedIncrement
InterlockedDecrement
VirtualQuery
VirtualProtect
SearchPathA
WaitForSingleObject
SetEvent
ResetEvent
QueryPerformanceCounter
SystemTimeToFileTime
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
GetStartupInfoA
GetCommandLineA
ExitProcess
RtlUnwind
GetTimeZoneInformation
GetSystemTime
RaiseException
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
TlsSetValue
TlsAlloc
TlsGetValue
VirtualFree
HeapReAlloc
HeapSize
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr

user32

GetDlgItemTextA
SetForegroundWindow
LoadStringA
PeekMessageA
GetDesktopWindow
ReleaseDC
GetDC
SetWindowLongA
GetClassInfoA
GetWindowLongA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetKeyState
ScreenToClient
MessageBeep
MapVirtualKeyA
VkKeyScanA
CharNextA
GetParent
DialogBoxIndirectParamA
SetFocus
IsRectEmpty
SubtractRect
EqualRect
IntersectRect
CopyRect
UnionRect
PtInRect
SendDlgItemMessageA
SetWindowTextA
LoadIconA
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
DestroyCursor
SetClassLongA
LoadCursorFromFileA
GetMessageTime
GetMessagePos
UpdateWindow
WaitForInputIdle
EnableWindow
GetClassInfoExA
SetParent
DrawIcon
ClientToScreen
GetIconInfo
DrawTextA
DrawTextW
InflateRect
DrawFrameControl
IsCharAlphaA
IsCharAlphaNumericA
DestroyCaret
ShowCaret
SetCaretBlinkTime
CreateCaret
CharLowerBuffA
CharUpperBuffA
SetCaretPos
GetScrollPos
ShowWindow
IsWindowVisible
IsIconic
EnumChildWindows
CreateWindowExA
InvalidateRect
SetCursorPos
GetCursorPos
ShowScrollBar
AppendMenuA
GetSystemMenu
UnregisterClassA
TrackPopupMenu
DestroyMenu
SetRectEmpty
GetFocus
GetWindow
GetForegroundWindow
SetScrollPos
GetScrollRange
SetScrollRange
WindowFromPoint
ValidateRect
IsDlgButtonChecked
CheckRadioButton
GetWindowTextA
CreatePopupMenu
SetRect
SystemParametersInfoA
CharLowerA
MsgWaitForMultipleObjects
IsWindow
DestroyWindow
GetMessageA
RegisterClassExA
DrawFocusRect
DispatchMessageA
CharUpperA
RegisterWindowMessageA
EndDialog
LoadBitmapA
SetTimer
FillRect
KillTimer
DialogBoxParamA
GetClientRect
GetWindowRect
SetDlgItemTextA
GetSystemMetrics
MoveWindow
GetDlgItem
SetWindowPos
BeginPaint
EndPaint
PostMessageA
wsprintfA
MessageBoxA
PostQuitMessage
DefWindowProcA
CreateDialogParamA
GetSysColor
FindWindowA
SendMessageA
RegisterClassA
TranslateMessage

gdi32

GetTextExtentPoint32A
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
CreateEllipticRgnIndirect
CreateDCA
GetTextMetricsA
StretchDIBits
RoundRect
Ellipse
SetTextCharacterExtra
TextOutA
SetTextAlign
ExtTextOutA
Polyline
CreatePolygonRgn
CreateRoundRectRgn
CreateEllipticRgn
GetPixel
SetPixel
CreateDIBitmap
LineTo
CreatePen
SetWinMetaFileBits
SetEnhMetaFileBits
PlayEnhMetaFile
SetStretchBltMode
CreateCompatibleBitmap
CreateBitmap
StretchBlt
DeleteEnhMetaFile
CreateHatchBrush
SetBkColor
Rectangle
DeleteObject
CreateSolidBrush
DeleteDC
BitBlt
SelectObject
RealizePalette
SelectPalette
UnrealizeObject
CreateCompatibleDC
SetTextColor
SetBkMode
GetStockObject
GetObjectA
CreateRectRgn
CreateRectRgnIndirect
MoveToEx
CreateFontIndirectA
EnumFontFamiliesExA
CombineRgn
AddFontResourceA
RemoveFontResourceA
SaveDC
SelectClipRgn
Polygon
EnumFontsA
PatBlt
CreatePatternBrush
RestoreDC

comdlg32

GetOpenFileNameA

ole32

CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize

oleaut32

SysAllocStringLen
SysFreeString

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

mixerSetControlDetails
mixerGetLineControlsA
mixerGetLineInfoA
mixerClose
mciSendCommandA
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeSetEvent
timeGetTime
mixerOpen

atl

ord47
ord40
ord42

Exports

Exports

AppEnumWindows
CaptureHookProc
DemoClosingDialog
DemoMenuDialog
DemoSplashDialog
EnumFontExProc
EventProcDll
JournalPlayHookProc
JournalRecordHookProc
KeyboardHookProc
LaunchAppProc
MouseHookProc
PlayerAbout
ServerWndProc
WinSupBackWndProc
WinSupWndProc

Sections

.text
Size: 384KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ab7028c689eda741357257b2e53cc729

Headers

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

advapi32

shell32

version

winmm

atl

Exports

Exports

Sections

.text Size: 384KB - Virtual size: 381KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 32KB - Virtual size: 39KB

.rsrc Size: 68KB - Virtual size: 67KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 384KB - Virtual size: 381KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 32KB - Virtual size: 39KB

.rsrc
Size: 68KB - Virtual size: 67KB

.UPX0
Size: 104KB - Virtual size: 252KB