f88fd3f9d1c6fe5fd271b5be9548b8e8

General

Target

f88fd3f9d1c6fe5fd271b5be9548b8e8
Size

43KB
MD5

f88fd3f9d1c6fe5fd271b5be9548b8e8
SHA1

4af673cfdea9fbd3571c7dd655b88d59530e11c5
SHA256

a356dbb53341b3c42b1148cd27800e18c6941c0cdea09a7baa125323c0e6ed6d
SHA512

79a8a6ae82b5f663d3c1a664b0cd0bb1eb12db0bcca48f6755a7315d32872efd8e31d5a5e59c337353e9863fe2cd450f6fa810ff096b998c58212f0aeda49711
SSDEEP

768:TvHJU3TfjjIyChIMAIWSDn0O/QnhTqZ+k:1UT/lw7D4TqX

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f88fd3f9d1c6fe5fd271b5be9548b8e8

Files

f88fd3f9d1c6fe5fd271b5be9548b8e8
.exe windows:4 windows x86 arch:x86

fa7f9ac13dc357a4d1703fdec8e12373

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
CreateThread
GetWindowsDirectoryA
GetSystemDirectoryA
GetShortPathNameA
GetModuleFileNameA
CloseHandle
Sleep
CreateEventA
OpenEventA
CreateRemoteThread
GlobalFree
GlobalUnlock
WaitForSingleObject
ReadProcessMemory
GlobalLock
GlobalAlloc
GetCurrentProcess
OpenProcess
WriteProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
GetTickCount
VirtualAllocEx
VirtualFreeEx
CopyFileA
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
LockResource
DeleteFileA
CreateFileA
WriteFile
FreeResource
ExitProcess
LoadLibraryA
GetProcAddress
FreeLibrary

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA

msvcrt

rand
srand
_stricmp
strlen
strcat
strcpy
memcpy
memset

user32

FindWindowA
GetDesktopWindow
GetWindow
GetWindowThreadProcessId
PostMessageA
GetWindowTextA

winmm

mixerGetLineInfoA
mixerOpen
mixerSetControlDetails
mixerGetLineControlsA
mixerGetControlDetailsA

Sections

UPX0
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa7f9ac13dc357a4d1703fdec8e12373

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

user32

winmm

Sections

UPX0 Size: 40KB - Virtual size: 40KB

.rsrc Size: 512B - Virtual size: 4KB

.avc Size: 1KB - Virtual size: 4KB

UPX0
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 512B - Virtual size: 4KB

.avc
Size: 1KB - Virtual size: 4KB