aa19c39285107091fbfd375484baf0c7

Sharing

Copy URL Twitter E-mail

General

Target

aa19c39285107091fbfd375484baf0c7
Size

340KB
MD5

aa19c39285107091fbfd375484baf0c7
SHA1

36883e5248a308a8025cde68092b97cc090f0e52
SHA256

79f2f3b4b95d9cea3492741fad9a4cb92084df83f6580a6f77f18aa11caabd01
SHA512

4900fc9fb22e7f162384dd223a551ced09832a84a51ded97bb8c0bd4923b1e649aee821b09553fe0f23e1f01157d988acc145a21bf86487c66d8f64f53dc0438
SSDEEP

1536:u7/U6YmaKPOYCCiOMN9d293BXrwHDqyPEm/V95xqPm8jaqD0wR/y:u7/UTma9uPq2JBEHWJm/bcjaS0wRK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa19c39285107091fbfd375484baf0c7

Files

aa19c39285107091fbfd375484baf0c7
.exe windows:4 windows x86 arch:x86

95186457fcdf70bd5469fd4895d61ce8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetTempFileNameA
GetTempPathA
SetFilePointer
SetEndOfFile
FindClose
FindNextFileA
FindFirstFileA
MoveFileA
GetTickCount
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
lstrcmpA
GetFileSize
SetThreadPriority
GetCurrentThread
CreateThread
ExitThread
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
SystemTimeToFileTime
GetLocalTime
lstrcmpiA
FreeLibrary
GlobalFree
GlobalAlloc
GetModuleFileNameA
WaitForMultipleObjects
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
CreateFileA
WriteFile
ReadFile
GetCurrentProcess
GetLastError
lstrcpyA
GetVersionExA
GetSystemTimeAsFileTime
GetWindowsDirectoryA
lstrlenA
lstrcpynA
DeleteFileA
ResumeThread
Sleep
CreateProcessA
CloseHandle
WaitForSingleObject
CreateDirectoryA
GetDriveTypeA
TerminateProcess

advapi32

OpenSCManagerA
ControlService
CreateServiceA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA

msvcrt

printf
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
atol
strchr
_stricmp
_strupr
fscanf
strncmp
fseek
ftell
fwrite
malloc
free
fputs
fclose
fgets
strcmp
fopen
sscanf
strstr
fprintf
memset
_endthreadex
_beginthreadex
atoi
memcpy

ole32

CoCreateGuid

shell32

ShellExecuteA
SHGetSpecialFolderPathA

user32

wsprintfA
wvsprintfA
CharLowerA

ws2_32

Sections

UPX0
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

95186457fcdf70bd5469fd4895d61ce8

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

ole32

shell32

user32

ws2_32

Sections

UPX0 Size: 336KB - Virtual size: 336KB

.avc Size: 3KB - Virtual size: 4KB

UPX0
Size: 336KB - Virtual size: 336KB

.avc
Size: 3KB - Virtual size: 4KB