1e33651fa199b547856431868f39600f

Sharing

Copy URL Twitter E-mail

General

Target

1e33651fa199b547856431868f39600f
Size

36KB
MD5

1e33651fa199b547856431868f39600f
SHA1

261fc87189349e492b04c6ce88fe963a57507ff3
SHA256

b047f7f11185c59468c56a28e633e1c60835c0276712ed66721529871f6da20a
SHA512

aec0a1c4f03cf71c757854472102aad63c09385b23e4cd9661218f1f3ae7e1df34842f3bf6b8ca9e200abf8f402bae9ffbc1573a4d149d3063f3f7d0fbefa24e
SSDEEP

384:m4jAcIN+or4bhSVuQdW7FgUIy1l6jYE0WLy:HAcE/sSoQA7Fgul3

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e33651fa199b547856431868f39600f

Files

1e33651fa199b547856431868f39600f
.exe windows:4 windows x86 arch:x86

bfb4175e6c14fc34114adc727aa41f7d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
closesocket
recv
WSACleanup
WSAGetLastError
WSAStartup
socket
htons
connect
send
WSAAsyncSelect

kernel32

GetStartupInfoA
GetCurrentProcessId
GetModuleHandleA
GetProcessHeap
HeapAlloc
GetTickCount
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ExitProcess
CreateProcessA
CopyFileA
DeleteFileA
GetModuleFileNameA
GetWindowsDirectoryA
CloseHandle
GetCurrentProcess
WriteFile
CreateFileA
GetSystemDirectoryA
ResumeThread
CreateThread
Sleep
ExpandEnvironmentStringsA
GetTempPathA
FreeLibrary
GetProcAddress
LoadLibraryA
MoveFileA

user32

wsprintfA
DefWindowProcA
ExitWindowsEx
PostQuitMessage
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA

advapi32

RegOpenKeyExA
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegRestoreKeyA

msvcp60

??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__dllonexit
printf
_itoa
sprintf
__CxxFrameHandler
strstr
strcspn
strncpy
atoi
_stricmp
_acmdln
exit
_XcptFilter
rand
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
_onexit

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CCM
Size: 4KB - Virtual size: 111B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xiaohui
Size: 40B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xiaohui
Size: 19B - Virtual size: 19B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfb4175e6c14fc34114adc727aa41f7d

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

msvcrt

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 12KB - Virtual size: 9KB

.CCM Size: 4KB - Virtual size: 111B

xiaohui Size: 40B - Virtual size: 40B

xiaohui Size: 19B - Virtual size: 19B

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 12KB - Virtual size: 9KB

.CCM
Size: 4KB - Virtual size: 111B

xiaohui
Size: 40B - Virtual size: 40B

xiaohui
Size: 19B - Virtual size: 19B