ca3c3778d577331818a9a5aced44b02c1f7e50c90feeb11ae91aa30dcfef73f4

Sharing

Copy URL Twitter E-mail

General

Target

ca3c3778d577331818a9a5aced44b02c1f7e50c90feeb11ae91aa30dcfef73f4
Size

900KB
MD5

736b031e68e3261514464ace0e40a32b
SHA1

ec8b2aca25ae2a6248b49ce4fdf360a5a020904e
SHA256

ca3c3778d577331818a9a5aced44b02c1f7e50c90feeb11ae91aa30dcfef73f4
SHA512

ad3d9b4672ac10f13fd61aa240326fe02fc7469344857be00bd50595fd64c5101f56ca96047f254035789f6fc980f82c5b32f4a6a9491c21479623e04bac0a96
SSDEEP

6144:cIjtmBOfLu+vE6OaMeKHQkjYR6C3aaT7bJwcaA6ZmQwCfRDFm0:cIjtmBAL1OaMeKwClkPJUMQdnm0

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

ca3c3778d577331818a9a5aced44b02c1f7e50c90feeb11ae91aa30dcfef73f4
.exe windows x86

d48dde2dd25ecb106a4c0175e1b0d0da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_addr
connect
WSACleanup
WSAStartup
socket
setsockopt
ioctlsocket
htons
bind
listen
send
select
__WSAFDIsSet
accept
recv
closesocket

kernel32

CreateFileMappingA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
ExitThread
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryA
GetLocalTime
Sleep
MultiByteToWideChar
ReadFile
CloseHandle
WriteFile
TransactNamedPipe
CreateFileA
GetModuleFileNameA
GetTimeFormatA
GetDateFormatA
GetLastError
CreateThread
GetFileSize
GetFileAttributesA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
SetFileTime
GetFileTime
CreateProcessA
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
GetCurrentProcess
CreatePipe
GetVersionExA
GlobalMemoryStatus
ExitProcess
WideCharToMultiByte
GetComputerNameA
TerminateProcess
DeleteFileA
GetCurrentProcessId
CopyFileA
WaitForSingleObject
CreateMutexA
TerminateThread
MoveFileA
SetConsoleCtrlHandler
GetLocaleInfoA
GetLogicalDrives
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetTimeZoneInformation
GetSystemTime
HeapReAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
UnhandledExceptionFilter

Sections

.text
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d48dde2dd25ecb106a4c0175e1b0d0da

Headers

File Characteristics

Imports

ws2_32

kernel32

Sections

.text Size: 720KB - Virtual size: 720KB

.rdata Size: 100KB - Virtual size: 100KB

UPX2 Size: 4KB - Virtual size: 4KB

.data Size: 72KB - Virtual size: 72KB

.text
Size: 720KB - Virtual size: 720KB

.rdata
Size: 100KB - Virtual size: 100KB

UPX2
Size: 4KB - Virtual size: 4KB

.data
Size: 72KB - Virtual size: 72KB