b95b81ec5104e3a3a3af3e3423a826f8e33138b8b1e8f269bebac2e5da0b8138[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

b95b81ec5104e3a3a3af3e3423a826f8e33138b8b1e8f269bebac2e5da0b8138.zip
Size

2.6MB
MD5

c78223d090b5b6569570ed0e058fa52b
SHA1

4847d6aba6c7e778babe92ef324f0381911c0c21
SHA256

3e6999fde89cd8fbbc0e23423bc8337a3ed7a25c7520e3c3adbd1cc22b09143a
SHA512

be2d23570be301d9148bf18b664d74273c75d99ba28a6ae3075435f35add8cb80ad96b717504e12ea63d7e09cb95e40aebdba43fbc39ce25adf12ac68cb5f1c0
SSDEEP

49152:VOqA+TZJK7yIvNvAU5eiPevAiGTAs5gYmmwYJrxF57T8z:VRG7yIvNvAUpWv1GkOgYT9rxvsz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/b95b81ec5104e3a3a3af3e3423a826f8e33138b8b1e8f269bebac2e5da0b8138	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b95b81ec5104e3a3a3af3e3423a826f8e33138b8b1e8f269bebac2e5da0b8138

Files

b95b81ec5104e3a3a3af3e3423a826f8e33138b8b1e8f269bebac2e5da0b8138.zip
.zip

Password: infected
b95b81ec5104e3a3a3af3e3423a826f8e33138b8b1e8f269bebac2e5da0b8138
.exe windows:6 windows x64 arch:x64

Password: infected

c0013219c9f690e3d65d197003570ced

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
SystemFunction036
RegCloseKey
FreeSid
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid

kernelbase

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
_amsg_exit
FlsAlloc
FlsSetValue
InitializeCriticalSectionEx
WaitOnAddress

ucrtbase

free
realloc
_msize
malloc
calloc
_set_new_mode
_configthreadlocale
roundf
__setusermatherr
ceil
exp2f
truncf
_dclass
log
pow
_get_initial_narrow_environment
terminate
_initterm_e
abort
_configure_narrow_argv
_set_app_type
_seh_filter_exe
exit
_Exit
_crt_atexit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_initterm
_endthreadex
_beginthreadex
_register_onexit_function
_initialize_onexit_table
_set_fmode
__p__commode
strncmp
strcspn
strcpy_s
strcmp
strlen
wcsncmp
_localtime64_s
qsort
_rotl64
free
_configthreadlocale
log
exit
_set_fmode
strcmp
_localtime64_s
qsort

bcrypt

BCryptGenRandom
BCryptGenRandom

bcryptprimitives

ProcessPrng
ProcessPrng

crypt32

CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertCloseStore
CertDuplicateCertificateContext
CryptUnprotectData
CertOpenStore
CertDuplicateStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertGetCertificateChain
CertOpenStore

gdi32

CreateCompatibleDC
CreateDCW
GetDeviceCaps
DeleteObject
GetObjectW
GetDIBits
StretchBlt
SetStretchBltMode
SelectObject
CreateCompatibleBitmap
DeleteDC
DeleteDC

kernel32

GetFileInformationByHandle
MultiByteToWideChar
GetCurrentThread
WideCharToMultiByte
GlobalSize
SetThreadStackGuarantee
AddVectoredExceptionHandler
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetExitCodeProcess
WaitForSingleObject
HeapReAlloc
GlobalFree
GetStdHandle
GetConsoleMode
WriteConsoleW
GetModuleHandleA
CreateWaitableTimerExW
SetWaitableTimer
GlobalUnlock
GetModuleHandleW
FormatMessageW
lstrlenW
GetEnvironmentVariableW
GetTempPathW
GetFileInformationByHandleEx
GetFullPathNameW
FlushFileBuffers
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
GetModuleFileNameW
GlobalLock
QueryPerformanceCounter
UnhandledExceptionFilter
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SetFileInformationByHandle
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
CreateEventW
CancelIo
GlobalAlloc
FatalExit
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
DeleteFileW
CopyFileExW
Sleep
SetUnhandledExceptionFilter
TerminateProcess
GetLastError
PostQueuedCompletionStatus
IsProcessorFeaturePresent
InitializeSListHead
LoadLibraryExA
FreeLibrary
IsDebuggerPresent
SwitchToThread
CloseHandle
HeapFree
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GetFinalPathNameByHandleW
ReadFile
GetQueuedCompletionStatusEx
EncodePointer
CreateFileW
CreateIoCompletionPort
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetFileCompletionNotificationModes
SleepEx
QueryPerformanceFrequency
LoadLibraryExW
LoadLibraryA
FatalExit
GetProcAddress
VirtualProtect

ntdll

RtlNtStatusToDosError
RtlPcToFileHeader
NtDeviceIoControlFile
NtCancelIoFileEx
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtReadFile
NtWriteFile
NtCreateFile
NtReadFile

combase

CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
CoInitializeEx

oleaut32

SafeArrayGetUBound
SafeArrayAccessData
SysAllocStringLen
GetErrorInfo
SafeArrayGetLBound
SafeArrayUnaccessData
VariantClear
SysFreeString
SafeArrayDestroy
SysStringLen
GetErrorInfo

rstrtmgr

RmRegisterResources
RmGetList
RmStartSession
RmGetList

secur32

InitializeSecurityContextW
SealMessage
ApplyControlToken
UnsealMessage
QueryContextAttributesW
FreeCredentialsHandle
AcceptSecurityContext
AcquireCredentialsHandleA
FreeContextBuffer
DeleteSecurityContext
SealMessage

user32

GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
OpenClipboard
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplaySettingsExW
OpenClipboard

ws2_32

getsockopt
select
getsockname
ioctlsocket
socket
WSAIoctl
setsockopt
getaddrinfo
WSAGetLastError
accept
listen
bind
closesocket
freeaddrinfo
WSAStartup
WSACleanup
recv
send
WSASend
shutdown
WSASocketW
getpeername
connect
WSACleanup
bind

Sections

UPX0
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UPX1
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

c0013219c9f690e3d65d197003570ced

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernelbase

ucrtbase

bcrypt

bcryptprimitives

crypt32

gdi32

kernel32

ntdll

combase

oleaut32

rstrtmgr

secur32

user32

ws2_32

Sections

UPX0 Size: 3.1MB - Virtual size: 3.1MB

UPX1 Size: 2.2MB - Virtual size: 2.2MB

UPX2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 50KB - Virtual size: 50KB

UPX0
Size: 3.1MB - Virtual size: 3.1MB

UPX1
Size: 2.2MB - Virtual size: 2.2MB

UPX2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 50KB - Virtual size: 50KB