c05e152e4b257f0d5151d32ce6ca55b1

Sharing

Copy URL

Twitter E-mail

General

Target

c05e152e4b257f0d5151d32ce6ca55b1
Size

55KB
MD5

c05e152e4b257f0d5151d32ce6ca55b1
SHA1

5cf7a3d014bc703555af960f63c7dd7ced803b5c
SHA256

d86aebc8e2b04efdf71aea2051012fc6bb8f5c3fb8eaed982e600354ae510dc8
SHA512

69acc561df729c05ed6755cb486bfadd4d38f9b724676ab2c90048199b1414db49009ea736e71a1c750410601346fbc48a9c1e5ec2556a98eb518c7937978de6
SSDEEP

1536:QtRLzDVbhfX1MSvoSq8gp+lJR6DHPhPd:+LzRbVFMShq88+lmBd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c05e152e4b257f0d5151d32ce6ca55b1

Files

c05e152e4b257f0d5151d32ce6ca55b1
.exe windows:5 windows x86 arch:x86

1c5363acf446b2b20a39622fefe2a988

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ReadFile
FlushInstructionCache
FlushFileBuffers
GetLongPathNameW
GetTempFileNameA
GetAtomNameA
InitializeCriticalSection
GetVolumeInformationA
GetModuleFileNameA
FreeEnvironmentStringsW
BuildCommDCBA
CloseHandle
GetTempPathA
ExpandEnvironmentStringsW
GetWindowsDirectoryA
GetTickCount
QueryDosDeviceW
CreateDirectoryExA
GlobalAlloc
WaitForSingleObject
_lwrite
OpenFile
GlobalDeleteAtom
EnumResourceNamesW
CreateTapePartition
GetCommandLineW
VirtualProtect

user32

SetScrollPos
CreateMenu
wsprintfA
SetUserObjectInformationA
ChangeMenuW
CreateMDIWindowA

gdi32

SetMetaFileBitsEx
Escape
EnumFontFamiliesExW
GetObjectA
AddFontResourceA
SetPixel
PolyTextOutW
DrawEscape
ColorMatchToTarget

ws2_32

htonl
htons
connect
recv
bind
socket
closesocket
gethostbyname
send
WSAStartup

shlwapi

StrStrIA

iphlpapi

GetAdaptersInfo

msvcrt

memset
memcpy

Sections

.text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: - Virtual size: 380B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.UPX2
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c5363acf446b2b20a39622fefe2a988

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

shlwapi

iphlpapi

msvcrt

Sections

.text Size: - Virtual size: 2KB

.rdata Size: - Virtual size: 17KB

.data Size: - Virtual size: 16B

.UPX0 Size: - Virtual size: 380B

.UPX1 Size: - Virtual size: 44KB

.UPX2 Size: 53KB - Virtual size: 53KB

.reloc Size: 512B - Virtual size: 36B

.text
Size: - Virtual size: 2KB

.rdata
Size: - Virtual size: 17KB

.data
Size: - Virtual size: 16B

.UPX0
Size: - Virtual size: 380B

.UPX1
Size: - Virtual size: 44KB

.UPX2
Size: 53KB - Virtual size: 53KB

.reloc
Size: 512B - Virtual size: 36B