af32a6bcb9b7982ee4aa440cc69aae712ebdffdc1fd7fc6a8a87316a3a951628

Sharing

Copy URL

Twitter E-mail

General

Target

af32a6bcb9b7982ee4aa440cc69aae712ebdffdc1fd7fc6a8a87316a3a951628
Size

991KB
MD5

7e1860609e010aae0d88fea5842cfd31
SHA1

a888703652f9a3494144b61140615aef46e9b360
SHA256

af32a6bcb9b7982ee4aa440cc69aae712ebdffdc1fd7fc6a8a87316a3a951628
SHA512

430c4c1a9a9441cc5575d00e8199303273b3ed9de904833d662e8ae74089a71079704645d1db8d8b591b163c673834bdf1a04547db956d43ab50454a5b13d776
SSDEEP

12288:dtIqOeamvX7iNB21y3b72sxfEYGHyRLovZR25jmYXMQnWXaEdi5NhRINDpQRPXMn:TIEriFH2sxfE1Ad1MPKRNfa2RvU0Dw

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Imagine.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Imagine.dll	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Imagine.dll
unpack002/out.upx
unpack001/Imagine.exe
unpack001/Imagine.wcx
unpack001/Imagine.wlx

Files

af32a6bcb9b7982ee4aa440cc69aae712ebdffdc1fd7fc6a8a87316a3a951628
.zip
Imagine.chm
.chm
Imagine.dll
.dll regsvr32 windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_mem_src
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 664KB - Virtual size: 668KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 197KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.exe
.exe windows:4 windows x86

359952f7236858b71497f85499e2614d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleW
FreeLibrary
GetCommandLineW
GetLastError
LoadLibraryW
lstrcpyW
GetModuleFileNameW
LocalFree
FormatMessageW
GetStartupInfoW
GetProcAddress

user32

TranslateMessage
GetMessageW
MessageBoxW
DispatchMessageW

Sections

.text
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine.wcx
.dll windows:4 windows x86

5d63995d1bd61b212e35a61ebc32711a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryW
lstrcpyW
GetModuleFileNameW
FreeLibrary
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrcatW
LocalFree
lstrlenW

user32

GetForegroundWindow
wsprintfW

Exports

Exports

CanYouHandleThisFileW
CloseArchive
GetPackerCaps
OpenArchive
OpenArchiveW
PackFiles
PackFilesW
PackSetDefaultParams
ProcessFile
ProcessFileW
ReadHeader
ReadHeaderEx
ReadHeaderExW
SetChangeVolProc
SetChangeVolProcW
SetProcessDataProc
SetProcessDataProcW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.wlx
.dll windows:4 windows x86

a9ff84b50e81c54cd824f51e791b269f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
lstrcpyW
GetModuleFileNameW
FreeLibrary
GetProcAddress

Exports

Exports

ListGetDetectString
ListGetPreviewBitmapW
ListLoad
ListLoadNextW
ListLoadW
ListPrintW
ListSendCommand
ListSetDefaultParams

Sections

.text
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 495B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language/Arabic.lng
Language/Belarusian.lng
Language/Bulgarian.lng
Language/Croatian.lng
Language/Czech.lng
Language/Danish.lng
Language/Estonian.lng
Language/French.lng
Language/German.lng
Language/Hungarian.lng
Language/Italiano.lng
Language/Japanese.lng
Language/Korean.lng
Language/Nederlands.lng
Language/Polish.lng
Language/Portuguese (Brazil).lng
Language/Portuguese (Portugal).lng
Language/Romanian.lng
Language/Russian.lng
Language/SimplifiedChinese.lng
Language/Slovenian.lng
Language/Spanish.lng
Language/Svenska.lng
Language/TraditionalChinese.lng
Language/Turkish.lng
Language/Ukrainian.lng
Language/Uzbek (O'zbekcha).lng
PlugInst.inf
Plugin/dir.txt
Readme.txt
Whatsnew.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 1.4MB

UPX1 Size: 664KB - Virtual size: 668KB

.rsrc Size: 197KB - Virtual size: 200KB

Headers

File Characteristics

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 226KB - Virtual size: 225KB

.data Size: 31KB - Virtual size: 280KB

.rsrc Size: 272KB - Virtual size: 272KB

.reloc Size: 47KB - Virtual size: 47KB

359952f7236858b71497f85499e2614d

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 1024B - Virtual size: 624B

.rdata Size: 1024B - Virtual size: 540B

.rsrc Size: 10KB - Virtual size: 10KB

5d63995d1bd61b212e35a61ebc32711a

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: - Virtual size: 12B

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 512B - Virtual size: 136B

a9ff84b50e81c54cd824f51e791b269f

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 976B

.rdata Size: 512B - Virtual size: 495B

.data Size: - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 512B - Virtual size: 80B

UPX0
Size: - Virtual size: 1.4MB

UPX1
Size: 664KB - Virtual size: 668KB

.rsrc
Size: 197KB - Virtual size: 200KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 226KB - Virtual size: 225KB

.data
Size: 31KB - Virtual size: 280KB

.rsrc
Size: 272KB - Virtual size: 272KB

.reloc
Size: 47KB - Virtual size: 47KB

.text
Size: 1024B - Virtual size: 624B

.rdata
Size: 1024B - Virtual size: 540B

.rsrc
Size: 10KB - Virtual size: 10KB

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 12B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 512B - Virtual size: 136B

.text
Size: 1024B - Virtual size: 976B

.rdata
Size: 512B - Virtual size: 495B

.data
Size: - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 512B - Virtual size: 80B