788f634e5af285ee744dd82cc5e65cef

Sharing

Copy URL Twitter E-mail

General

Target

788f634e5af285ee744dd82cc5e65cef
Size

131KB
MD5

788f634e5af285ee744dd82cc5e65cef
SHA1

0c680ed6c19ceae9c037bccd508b4fb5dc05fae2
SHA256

f0beacc7cb4c600ad37d19896af9b54cc34020e377c92bb0f7871506cab9f9bc
SHA512

d6ee67075866cb54f6386b76aca8cd8ced173765c6a678517aaa6b56319979dde41f38c15e711766513733ab4a415cc46db4857b4a6f7c76931ae15dfd281e96
SSDEEP

3072:nAiFQmC1JqXjE2cY3VVrsY5n5S0hyD1Xrxz7jaNQASAu:n5FzCIBL3Vyy5FMNrpMQASb

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
788f634e5af285ee744dd82cc5e65cef

Files

788f634e5af285ee744dd82cc5e65cef
.exe windows:5 windows x86 arch:x86

9d74fafa96c66a1f1b9bdf943964820d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cacls.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
_cexit
_XcptFilter
_exit
_c_exit
setlocale
exit
wprintf
wcscat
fgets
_stricmp
printf
wcschr
_iob
vswprintf
fprintf
fwprintf
_wcsnicmp
_wcsicmp
wcslen
wcscpy
wcscmp
??2@YAPAXI@Z
??3@YAXPAX@Z

advapi32

TreeResetNamedSecurityInfoW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
GetSecurityDescriptorDacl
AddAce
InitializeAcl
EqualSid
GetLengthSid
LookupAccountNameW
LookupAccountSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorControl

kernel32

lstrcmpiW
GetStdHandle
GetConsoleMode
lstrlenW
WideCharToMultiByte
WriteConsoleW
FindFirstFileW
FindNextFileW
FindClose
GetLastError
LocalAlloc
LocalFree
GetCurrentProcessId
FormatMessageW
LoadLibraryExA
GetVolumeInformationW
GetVolumePathNameW
FormatMessageA
GetFileAttributesW
GetVolumeNameForVolumeMountPointW
QueryPerformanceCounter
GetTickCount
SetThreadUILanguage
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFullPathNameW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9d74fafa96c66a1f1b9bdf943964820d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 4KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

.UPX0
Size: 108KB - Virtual size: 260KB