_Z8upx_mainiPPc
Static task
static1
Behavioral task
behavioral1
Sample
libupx.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libupx.dll
Resource
win10v2004-20240508-en
General
-
Target
libupx.dll
-
Size
2.7MB
-
MD5
e822539bb790f9fc44a54cd11cef7017
-
SHA1
21c40e0aa155eb9465e2e1ebd535491eac588b6e
-
SHA256
66212a735018a983be2c0cab77b37a58e5d01cd68cd6fe0d4a72f2186f2bcb9e
-
SHA512
66813cd03093099b9a570d32dec770f31b47388a4e189cd3e7b0746951831edeacf04203b5f408af3b0640787bd1b440232b5fe033e30e6f2d53cdcd7eabf3e1
-
SSDEEP
24576:TdPjpHfUTHgqfaGL0YAlbHUy4eAQbnbH0wvAh2ezQlOW43TZHQMsRAv0FridHt0:JPlMTHgkaGL06eAQbngweQAZG
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource libupx.dll
Files
-
libupx.dll.dll windows:4 windows x64 arch:x64
2430e957d0d667339aa839a62cc102b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
DebugBreak
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount64
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
ScrollConsoleScreenBufferA
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleOutputA
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
__lconv_init
_amsg_exit
_beginthreadex
_endthreadex
_errno
_filelengthi64
_fileno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_isatty
_kbhit
_lock
_lseeki64
_setjmp
_stat64
_time64
_ultoa
_unlock
_utime64
_vsnprintf
_wfopen
_wopen
abort
atoi
calloc
clock
exit
fclose
fflush
fgetpos
fgetwc
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
islower
isspace
iswctype
isxdigit
localeconv
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
putwc
qsort
rand
realloc
rename
setlocale
setvbuf
signal
srand
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strrchr
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcstombs
wcsxfrm
_vsnwprintf
_strtoui64
_strtoi64
_write
_unlink
_stricmp
_strdup
_sopen
_setmode
_rmdir
_read
_open
_isatty
_fileno
_fdopen
_dup
_close
_chmod
Exports
Exports
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 15KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 77B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ