cdb5d30357cfb6a8a3b2563007498534d7e34217fc2e57cf189135be6a9455b3

Sharing

Copy URL Twitter E-mail

General

Target

cdb5d30357cfb6a8a3b2563007498534d7e34217fc2e57cf189135be6a9455b3
Size

726KB
MD5

c229c91288e970fede4c1de8b4a7084a
SHA1

67a3fb716fb793a321894da75f3c676a6068ac7f
SHA256

cdb5d30357cfb6a8a3b2563007498534d7e34217fc2e57cf189135be6a9455b3
SHA512

193878df9ff265ded1583eed46de251a5eb47389b75959ca2a4868029598193d8bf7bc804df88db487ba8b3223d485fce2c7923bccff8c818034912cd45de230
SSDEEP

12288:/njZwvgAMyRfKPyLtLE0MYWeCvC5HKO0mJulHqybLHuFYsMlojOt969f576pGHN5:/jIFMyJpE04fCgQXezuFYboNNrI4V

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

cdb5d30357cfb6a8a3b2563007498534d7e34217fc2e57cf189135be6a9455b3
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

??0utility_ini@@QAE@ABV0@@Z
??0utility_ini@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0utility_ini@@QAE@XZ
??0utility_libfilesys@@QAE@XZ
??0utility_simple_thread@@QAE@XZ
??1utility_ini@@QAE@XZ
??1utility_libfilesys@@QAE@XZ
??1utility_simple_thread@@QAE@XZ
??4utility_StringA@@QAEAAV0@ABV0@@Z
??4utility_ini@@QAEAAV0@ABV0@@Z
??4utility_libfilesys@@QAEAAV0@ABV0@@Z
??4utility_simple_thread@@QAEAAV0@ABV0@@Z
??_B?1??GetInstance@utility_libfilesys@@SAAAV1@XZ@51
?AppendFormat@utility_StringA@@QAAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ
?AutoToAbsolutePath@utility_libfilesys@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CharArrayToBitStr@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PADID@Z
?CharArrayToHexStr@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PADID@Z
?CopyTo@utility_libfilesys@@QAE_NPBD0@Z
?DirCreate@utility_libfilesys@@QAEHPBD@Z
?DirExist@utility_libfilesys@@QAEHPBD@Z
?EnsureParentDir@utility_libfilesys@@QAEHPBD@Z
?FileDelete@utility_libfilesys@@QAEHPBD@Z
?FileExist@utility_libfilesys@@QAEHPBD@Z
?FileExistAndCanRead@utility_libfilesys@@QAEHPBD@Z
?FileReadBinary@utility_libfilesys@@QAEPADPBDPAJ@Z
?FileWrite@utility_libfilesys@@QAE_NPBD0I_N@Z
?FindDirs@utility_libfilesys@@QAE_NPBDP6A_N0PAXH@Z1_N@Z
?FindFiles@utility_libfilesys@@QAE_NPBDP6A_N0PAXH@Z1_N0@Z
?Format@utility_StringA@@QAAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ
?FromHexStr@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@D@Z
?GetAndSetFloat@utility_ini@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAMMPBD@Z
?GetAndSetInt@utility_ini@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAHHPBD@Z
?GetAndSetString@utility_ini@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@PBD2@Z
?GetAppRunDir@utility_libfilesys@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetAppRunPath@utility_libfilesys@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetFileExt@utility_libfilesys@@QAEHPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetFileModifyTime@utility_libfilesys@@QAE_JPBD@Z
?GetFileName@utility_libfilesys@@QAEHPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetFileNameWithoutExt@utility_libfilesys@@QAEHPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetIniPath@utility_ini@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetInstance@utility_libfilesys@@SAAAV1@XZ
?GetInt@utility_ini@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HPBD@Z
?GetMap@utility_ini@@QAE_NAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@PBD@Z
?GetParentDir@utility_libfilesys@@QAEHPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetString@utility_ini@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@PBD@Z
?HexStrToVector@utility_StringA@@QAEXAAV?$vector@DV?$allocator@D@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@D@Z
?IndexOf@utility_StringA@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAD@Z
?IsAbsolutePath@utility_libfilesys@@QAE_NPBD@Z
?Join@utility_StringA@@QAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDHZZ
?Join@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@@Z
?Length@utility_StringA@@QAEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Replace@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@00@Z
?Reverse@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?SetIniPath@utility_ini@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Split@utility_StringA@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@@Z
?Split@utility_StringA@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDP6AXPADHHPAX@Z3@Z
?SplitString@utility_StringA@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@@Z
?SplitString@utility_StringA@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0P6AXAAV23@PAX@Z2@Z
?StrToBitStr@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@D@Z
?StrToHexStr@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@D@Z
?SubString@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@II@Z
?ToLower@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?ToUpper@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?Trim@utility_StringA@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@D@Z
?WriteInt@utility_ini@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HPBD@Z
?WriteString@utility_ini@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PBD@Z
?defaultAreaStr@utility_ini@@2PADA
?ent@?1??GetInstance@utility_libfilesys@@SAAAV2@XZ@4V2@A
?instance@utility_StringA@@2V1@A
?instance@utility_simple_thread@@2V1@A
?threadEnd@utility_simple_thread@@QAEXI@Z
?threadStart@utility_simple_thread@@QAEIP6GIPAX@Z0@Z

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 637KB - Virtual size: 640KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 1.2MB

UPX1 Size: 637KB - Virtual size: 640KB

.rsrc Size: 88KB - Virtual size: 88KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 276KB - Virtual size: 275KB

.data Size: 24KB - Virtual size: 51KB

.rsrc Size: 80KB - Virtual size: 79KB

.reloc Size: 141KB - Virtual size: 140KB

UPX0
Size: - Virtual size: 1.2MB

UPX1
Size: 637KB - Virtual size: 640KB

.rsrc
Size: 88KB - Virtual size: 88KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 276KB - Virtual size: 275KB

.data
Size: 24KB - Virtual size: 51KB

.rsrc
Size: 80KB - Virtual size: 79KB

.reloc
Size: 141KB - Virtual size: 140KB