20022d431c8d05e7c8789807262ed1f4191477b1f1355a438a8914a8dd297f7e

Sharing

Copy URL Twitter E-mail

General

Target

20022d431c8d05e7c8789807262ed1f4191477b1f1355a438a8914a8dd297f7e
Size

8.6MB
MD5

478cb004890d4b969a683c1b5e0638e0
SHA1

599830eb405fa2cc432c6349c2bf1538fe81be11
SHA256

20022d431c8d05e7c8789807262ed1f4191477b1f1355a438a8914a8dd297f7e
SHA512

5d2cfd9ec35da5116f64b558a1b8fc0964b7a0a3c8655a730409bf3b7cf0bb4c05e39662722822b2db3dea93e67971d8127cc020e8a207c586f108c45195b539
SSDEEP

196608:ha+MZmqcSbL7wteziwpECv0n3RawNNFOdDyCQe6jJ:hTzqcSbL7owaCv9b4vN

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20022d431c8d05e7c8789807262ed1f4191477b1f1355a438a8914a8dd297f7e

Files

20022d431c8d05e7c8789807262ed1f4191477b1f1355a438a8914a8dd297f7e
.dll windows:6 windows x64 arch:x64

eb64c22418206a35aa4f51b71503247e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memcpy
memmove
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

fread
fclose
fflush
fgetc
fgetpos
fsetpos
fputc
ungetc
fwrite
_fseeki64
_get_stream_buffer_pointers
setvbuf

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_invalid_parameter_noinfo_noreturn
_cexit
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
GetModuleHandleA
GetProcAddress
ExitProcess
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA

api-ms-win-crt-math-l1-1-0

sin
acos
pow
cos
sqrt
tan
exp

Exports

Exports

?dmgParams@@3UDamageParameters@@A
?efmParams@@3UEFMParameters@@A
?fmConfig@@3UFMConfig@@A
?fmParams@@3UFMParameters@@A
?g_StoresDamageFailure@@3V?$vector@HV?$allocator@H@std@@@std@@A
ed_fm_LERX_vortex_update
ed_fm_add_global_force
ed_fm_add_global_moment
ed_fm_add_local_force
ed_fm_add_local_force_component
ed_fm_add_local_moment
ed_fm_add_local_moment_component
ed_fm_change_mass
ed_fm_cold_start
ed_fm_configure
ed_fm_debug_watch
ed_fm_enable_debug_info
ed_fm_get_external_fuel
ed_fm_get_internal_fuel
ed_fm_get_param
ed_fm_get_shake_amplitude
ed_fm_hot_start
ed_fm_hot_start_in_air
ed_fm_make_balance
ed_fm_need_to_be_repaired
ed_fm_on_damage
ed_fm_on_planned_failure
ed_fm_pop_simulation_event
ed_fm_push_simulation_event
ed_fm_refueling_add_fuel
ed_fm_release
ed_fm_repair
ed_fm_set_atmosphere
ed_fm_set_command
ed_fm_set_current_mass_state
ed_fm_set_current_state
ed_fm_set_current_state_body_axis
ed_fm_set_draw_args
ed_fm_set_easy_flight
ed_fm_set_external_fuel
ed_fm_set_immortal
ed_fm_set_internal_fuel
ed_fm_set_plugin_data_install_path
ed_fm_set_property_numeric
ed_fm_set_property_string
ed_fm_set_surface
ed_fm_simulate
ed_fm_suspension_feedback
ed_fm_unlimited_fuel

Sections

.text
Size: - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX1
Size: - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX2
Size: - Virtual size: 322B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX3
Size: - Virtual size: 570B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX4
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX5
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX6
Size: 8.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb64c22418206a35aa4f51b71503247e

Headers

DLL Characteristics

File Characteristics

Imports

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 65KB

.rdata Size: - Virtual size: 15KB

.data Size: - Virtual size: 13KB

.pdata Size: - Virtual size: 2KB

.UPX0 Size: - Virtual size: 480B

.UPX1 Size: - Virtual size: 176B

.UPX2 Size: - Virtual size: 322B

.UPX3 Size: - Virtual size: 570B

.UPX4 Size: - Virtual size: 4.9MB

.UPX5 Size: 2KB - Virtual size: 2KB

.UPX6 Size: 8.6MB - Virtual size: 8.6MB

.reloc Size: 512B - Virtual size: 268B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 65KB

.rdata
Size: - Virtual size: 15KB

.data
Size: - Virtual size: 13KB

.pdata
Size: - Virtual size: 2KB

.UPX0
Size: - Virtual size: 480B

.UPX1
Size: - Virtual size: 176B

.UPX2
Size: - Virtual size: 322B

.UPX3
Size: - Virtual size: 570B

.UPX4
Size: - Virtual size: 4.9MB

.UPX5
Size: 2KB - Virtual size: 2KB

.UPX6
Size: 8.6MB - Virtual size: 8.6MB

.reloc
Size: 512B - Virtual size: 268B

.rsrc
Size: 512B - Virtual size: 469B