5ab19d726e205c01d675c9bbe14601893537ec8474442d006aeda75e9bc7aff4

Sharing

Copy URL Twitter E-mail

General

Target

5ab19d726e205c01d675c9bbe14601893537ec8474442d006aeda75e9bc7aff4
Size

458KB
MD5

f5ddcaddec4ec40b2a0c8e606215bb03
SHA1

c9a8eb0b49299a74f62c8769d5097304c394186f
SHA256

5ab19d726e205c01d675c9bbe14601893537ec8474442d006aeda75e9bc7aff4
SHA512

38f75f8af0ac7c40767996ef18dca5fecb5aa134fde266e533adb469e92892277c639f38e9832ba83c9e3d1a25caa4f95e97097f7711a73c02afe6f22e4ddd60
SSDEEP

12288:tfkU1UsSAuzWrgtoRoUaDgBHm+iGc4Yah:tLSbqrkoEDgBBiGc4Y

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
5ab19d726e205c01d675c9bbe14601893537ec8474442d006aeda75e9bc7aff4
unpack001/out.upx

Files

5ab19d726e205c01d675c9bbe14601893537ec8474442d006aeda75e9bc7aff4
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Sections

UPX0
Size: - Virtual size: 732KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 268KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Exports

Exports

PSA_CheckFeaturesGrantedByLicense
PSA_DisableFeaturesGrantedByLicense
PSA_DummyFunction
PSA_GetFeaturesGrantedByLicense
PSA_GetLicenseConfirmationTime
PSA_GetLicenseConfirmationTimeLimit
PSA_GetLicenseCreationDateTime
PSA_GetLicenseExecutionTimeLimit
PSA_GetLicenseExpirationDateTime
PSA_GetLicenseInformation
PSA_GetLicenseLifeTimeLimit
PSA_GetLicenseNumberOfRunsLimit
PSA_GetLicenseStartDateTime
PSA_GetLicenseStoragePath
PSA_GetNumberOfConnections
PSA_GetRemainingExecutionTime
PSA_GetRemainingExecutionTimeAtStart
PSA_GetRemainingNumberOfRuns
PSA_GetTimeRemainingToLicenseConfirmation
PSA_GetTimeToLicenseExpiration
PSA_GetUserDefinedField16Bits
PSA_IsDemoMode
PSA_IsLicenseActivatedAsTrial
PSA_IsLicenseExpired
PSA_IsLicenseNeedConfirmation
PSA_IsTrialMode
PSA_Uninitialize
PSC_ActivateAutomatically
PSC_EnterGlobalCriticalSection
PSC_FinishInitializationFailure
PSC_FinishInitializationSuccess
PSC_GetErrorInformation
PSC_GetLicenseId
PSC_HardwareActivateAndStoreNormalLicense
PSC_HardwareCreateOrLoadNormalLicenseAndGetHardwareCode
PSC_HardwareTryNormalLicense
PSC_HardwareTryTrialLicense
PSC_LeaveGlobalCriticalSection
PSC_LoadString
PSC_PerformInitializationAtValidLicense
PSC_StartInitialization
PSC_Uninitialize
PSC_ValidateLicenseNumber
PSE_ActivateAutomatically
PSE_CollectSystemInformation
PSE_DisplayExceptionMessage
PSE_GetCurrentLanguage
PSE_GetHostProcessId
PSE_GetInteger
PSE_GetListOfLicenseNumbers
PSE_GetNativeOsVersion
PSE_GetOverlay2
PSE_GetString
PSE_GetUserInterfaceModulePathName
PSE_IsActivatorMode
PSE_IsActivatorModeForApplicationLaunchingViaHelper
PSE_IsApplicationLaunchingMode
PSE_IsElmApplication
PSE_IsElmLoader
PSE_IsGuiAvailable
PSE_IsPathDefined
PSE_IsReadOnlyAccessToLicenses
PSE_IsTransceiverValid
PSE_LoadString
PSE_LogErrorEvent
PSE_LogInformationEvent
PSE_LogWarningEvent
PSE_MemoryAlloc
PSE_MemoryFree
PSE_NoGuiReportError
PSE_ReadInteger
PSE_ReadLastNagScreenTime
PSE_ReadString
PSE_RunHelper
PSE_SetCurrentLanguage
PSE_SetInteger
PSE_SetString
PSE_ThrowStringException
PSE_WriteInteger
PSE_WriteLastNagScreenTime
PSE_WriteRegFile
PSE_WriteString
ProtectSdkVersion

Sections

.text
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 732KB

UPX1 Size: 268KB - Virtual size: 272KB

.rsrc Size: 78KB - Virtual size: 80KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 537KB - Virtual size: 536KB

.rdata Size: 278KB - Virtual size: 277KB

.data Size: 15KB - Virtual size: 42KB

.rsrc Size: 77KB - Virtual size: 77KB

.reloc Size: 43KB - Virtual size: 42KB

UPX0
Size: - Virtual size: 732KB

UPX1
Size: 268KB - Virtual size: 272KB

.rsrc
Size: 78KB - Virtual size: 80KB

.text
Size: 537KB - Virtual size: 536KB

.rdata
Size: 278KB - Virtual size: 277KB

.data
Size: 15KB - Virtual size: 42KB

.rsrc
Size: 77KB - Virtual size: 77KB

.reloc
Size: 43KB - Virtual size: 42KB