bc827f995230c4ca748868b712bdf055

Sharing

Copy URL Twitter E-mail

General

Target

bc827f995230c4ca748868b712bdf055
Size

5.9MB
MD5

bc827f995230c4ca748868b712bdf055
SHA1

ce54dd1636732f47949e8e6002850983aacfdc0a
SHA256

cd228af4a5ebeaf71b78724f3cd410dffa3b4d76654b419c5923ffa0f7773aba
SHA512

179889a23fbee65e6b410f482b85d23a455c10082d5dcffd1da3a0aa857f35f96ed5a9b799e4f967901878aad4c6b868e32808588d82f65027fa64dcc07ae4c2
SSDEEP

98304:Q0k+oE1FXUj0xAqtvEwiPfQ4aRTuKq2KQ5/mIr2if9Q99CtWq83VSM2nrO:1boELn2qpEwi3Q4a625LrhfDJ803

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc827f995230c4ca748868b712bdf055

Files

bc827f995230c4ca748868b712bdf055
.dll windows:5 windows x86 arch:x86

626dc7a2eda565e3d3946c7c24bbb46b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

tier0_s

g_pMemAllocSteam

vstdlib_s

V_vsnprintf

kernel32

GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetActiveWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

DeleteObject

psapi

EnumProcessModules

dbghelp

MiniDumpWriteDump

winmm

mixerOpen

wtsapi32

WTSSendMessageW

Exports

Exports

Breakpad_SteamMiniDumpInit
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
Steam_BGetCallback
Steam_FreeLastCallback
Steam_GetAPICallResult

Sections

.text
Size: - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

626dc7a2eda565e3d3946c7c24bbb46b

Headers

DLL Characteristics

File Characteristics

Imports

tier0_s

vstdlib_s

kernel32

user32

gdi32

psapi

dbghelp

winmm

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 638KB

.rdata Size: - Virtual size: 193KB

.data Size: - Virtual size: 60KB

.gfids Size: - Virtual size: 248B

.tls Size: - Virtual size: 9B

_RDATA Size: - Virtual size: 1KB

.UPX0 Size: - Virtual size: 3.4MB

.UPX1 Size: 5.9MB - Virtual size: 5.9MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 638KB

.rdata
Size: - Virtual size: 193KB

.data
Size: - Virtual size: 60KB

.gfids
Size: - Virtual size: 248B

.tls
Size: - Virtual size: 9B

_RDATA
Size: - Virtual size: 1KB

.UPX0
Size: - Virtual size: 3.4MB

.UPX1
Size: 5.9MB - Virtual size: 5.9MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 469B