996c77aa0a40bb1603b5acaea8b058f5

Sharing

Copy URL Twitter E-mail

General

Target

996c77aa0a40bb1603b5acaea8b058f5
Size

395KB
MD5

996c77aa0a40bb1603b5acaea8b058f5
SHA1

0e9b6e9732f2a85d6b5e7a14f2b666bc41186d30
SHA256

7b973e32a98ded697f674e1df0ef44f56eb2e4999dda9d45785fcd8e86a7eb51
SHA512

6d604ddc908eb0a0fbe6362182d2fdf168288e682f4bed593744c2c914d5bccb9abde0026d22deb014237b8e99664075973ac17c72d540f58a71a2cbfe6477f0
SSDEEP

12288:1cs4r1SMX+pd167QhE0qX+pd167QhE0DhXPkFF+3KMwOBuPKtdzk:1p81SME6EhWE6EhnVkFF+3KMOKHk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
996c77aa0a40bb1603b5acaea8b058f5

Files

996c77aa0a40bb1603b5acaea8b058f5
.exe windows:6 windows x86 arch:x86

9970fa4104e4c405b7ecd7c2ba1e5649

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ieinstal.pdb

Imports

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
RegOpenKeyExW
RegEnumValueW
RegSetValueExA
RegQueryValueExA
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyA
RegOpenKeyExA
ConvertStringSidToSidW
EqualSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
CopySid
CreateWellKnownSid
TraceEvent
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
GetSidSubAuthority
RegOpenCurrentUser
RegOverridePredefKey
GetTokenInformation
OpenProcessToken
InitializeAcl
GetLengthSid
IsValidSid
GetAce
GetSecurityDescriptorSacl
GetKernelObjectSecurity
SetSecurityInfo
GetSidSubAuthorityCount

kernel32

DeleteFileW
lstrcmpiW
lstrlenW
lstrcmpiA
lstrlenA
DeleteFileA
SetFileAttributesA
CreateProcessW
LoadLibraryExW
GetExitCodeThread
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
LocalFree
LocalAlloc
FindClose
FindNextFileA
lstrcmpA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryExA
GetFileAttributesA
GetTempPathA
CopyFileW
InterlockedCompareExchange
CreateEventW
HeapSetInformation
SetEvent
UnhandledExceptionFilter
TerminateProcess
GetVersionExA
OpenEventW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetProcAddress
CreateFileW
GetFileAttributesW
GetCurrentProcess
OpenProcess
DuplicateHandle
CloseHandle
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetProcessShutdownParameters
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
VirtualQuery
VirtualProtect
FlushInstructionCache
VirtualAlloc
InterlockedExchange
GetModuleHandleW
GetLastError
ResumeThread
HeapFree
GetProcessHeap
HeapAlloc
CreateThread
GetThreadContext
SetThreadContext
SuspendThread
SetLastError
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetModuleFileNameW

user32

GetSystemMetrics
PostQuitMessage
CharNextW
LoadStringW

msvcrt

?terminate@@YAXXZ
memset
_vsnwprintf
wcsrchr
_vsnprintf
_wcsnicmp
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_amsg_exit
wcstok
_controlfp
__setusermatherr
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
__p__fmode
__p__commode

psapi

GetModuleBaseNameW

ole32

CoCreateInstance
CoRevertToSelf
CoImpersonateClient
CoTaskMemAlloc
CoTaskMemFree
CoRegisterClassObject
CoGetCallContext
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
CoInitialize
CoUninitialize
CoRevokeClassObject

oleaut32

UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
SysAllocString
SysFreeString

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

urlmon

Extract
CompatFlagsFromClsid
CoInternetCreateSecurityManager
ord107
CoInternetSetFeatureEnabled

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATAdminAddCatalog
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext

iertutil

ord201
ord200
ord9

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9970fa4104e4c405b7ecd7c2ba1e5649

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

psapi

ole32

oleaut32

rpcrt4

urlmon

wintrust

iertutil

Sections

.text Size: 48KB - Virtual size: 48KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 194KB - Virtual size: 194KB

.reloc Size: 6KB - Virtual size: 5KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 48KB - Virtual size: 48KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 194KB - Virtual size: 194KB

.reloc
Size: 6KB - Virtual size: 5KB

UPX0
Size: 144KB - Virtual size: 380KB