f2505c00835131e65d2f46174220546ff2c29b643c51ba5e2cc02d31964090e8

Sharing

Copy URL

Twitter E-mail

General

Target

f2505c00835131e65d2f46174220546ff2c29b643c51ba5e2cc02d31964090e8
Size

457KB
MD5

2eeccb27eab2507a7fe8a45dda4eb5fb
SHA1

de2cdf5a2270ff4c990963c879f1c84df484fd65
SHA256

f2505c00835131e65d2f46174220546ff2c29b643c51ba5e2cc02d31964090e8
SHA512

44d52162012e0a0fa45ce75386fcb1301847a1d432d97cb0daf75d3600d8438e4416175b543c542d444661b9c051b8d4c34c8d9e8bbad255c9e1bb5af337152c
SSDEEP

12288:Yfg4wQY3nvcjzQBz2Xxc2HywzmaSwFKvt:/NQY3n0PQp2XxcyhlSEK1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2505c00835131e65d2f46174220546ff2c29b643c51ba5e2cc02d31964090e8

Files

f2505c00835131e65d2f46174220546ff2c29b643c51ba5e2cc02d31964090e8
.exe windows:6 windows x86 arch:x86

cd21949848883f845c44aff689327590

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WerFault.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
MD5Init
MD5Update
MD5Final
RegSetKeyValueW
EventRegister
EventWrite
EventUnregister
ConvertSidToStringSidW
EqualSid
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
GetKernelObjectSecurity
GetSecurityDescriptorDacl
OpenThreadToken
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity
IsValidSid
GetLengthSid
CopySid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
StopTraceW
QueryTraceW
StartTraceW
EnableTrace
RegOpenKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegDeleteKeyW
CreateProcessAsUserW
OpenProcessToken

kernel32

CreateProcessW
GetModuleFileNameW
RegEnumKeyExW
DeleteFileW
RegEnumValueW
FileTimeToSystemTime
WriteFile
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
RegGetValueW
RegQueryValueExW
GetSystemDefaultLangID
GetProductInfo
GetSystemInfo
LocalFree
MoveFileExW
SetFileAttributesW
GetDiskFreeSpaceExW
ReadFile
GetLocalTime
CreateDirectoryW
SetPriorityClass
OpenProcess
DeviceIoControl
GetFileAttributesW
ReadProcessMemory
LoadLibraryW
SystemTimeToFileTime
GetSystemTime
FreeLibraryAndExitThread
GetExitCodeThread
CreateThread
GetModuleHandleExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapFree
HeapAlloc
GetProcessHeap
OpenFileMappingW
DuplicateHandle
LoadLibraryExW
QueryFullProcessImageNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetThreadUILanguage
GetNativeSystemInfo
SearchPathW
IsWow64Process
GetSystemDirectoryW
GetUserDefaultUILanguage
GetProcessTimes
GetApplicationRestartSettings
MultiByteToWideChar
lstrlenW
FormatMessageW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetFileSize
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetFileInformationByHandle
GetLongPathNameW
GetTempPathW
GetTempFileNameW
GetFileSizeEx
CheckRemoteDebuggerPresent
RegQueryInfoKeyW
VirtualQuery
SetEvent
GetPriorityClass
GetModuleHandleW
SetEnvironmentVariableW
CreateEventW
GetStringTypeExW
ResetEvent
K32GetModuleFileNameExW
Thread32Next
OpenThread
Thread32First
InitializeCriticalSection
SetThreadpoolWait
EnterCriticalSection
LeaveCriticalSection
GetThreadContext
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetProcessId
DeleteCriticalSection
CreateThreadpoolWait
GetProcessIoCounters
GetThreadTimes
GetThreadId
GetProcessIdOfThread
LCMapStringW
OutputDebugStringA
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
OpenEventW
K32EnumProcessModules
GlobalMemoryStatus
Module32NextW
Module32FirstW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
FindNextFileNameW
FindFirstFileNameW
CompareFileTime
FindFirstFileExW
GetCurrentThread
GetThreadPriority
SetThreadPriority
WTSGetActiveConsoleSessionId
GetVersionExW
SetLastError
RegDeleteValueW
RegCloseKey
OpenMutexW
GetCommandLineW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
SetErrorMode
HeapSetInformation
WaitForSingleObject
GetProcAddress
InitializeCriticalSectionAndSpinCount
ReleaseMutex
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
CompareStringW
CreateMutexW
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
DelayLoadFailureHook

user32

GetProcessWindowStation
LoadStringW
DispatchMessageW
TranslateMessage
IsHungAppWindow
GetClassNameW
GetWindow
IsWindowEnabled
GetWindowThreadProcessId
SendMessageW
SetWindowPos
GetWindowLongW
GetThreadDesktop
EnumWindows
MonitorFromPoint
GetSystemMetrics
LogicalToPhysicalPoint
GetMonitorInfoW
MonitorFromWindow
IsIconic
GetWindowRect
SetWindowLongW
EndDialog
PostMessageW
LoadIconW
DefWindowProcW
RegisterErrorReportingDialog
CheckWindowThreadDesktop
IsWindow
GetUserObjectInformationW
GetMessageW
RegisterWindowMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
ChangeWindowMessageFilter

msvcrt

iswspace
wcspbrk
_CxxThrowException
memcpy
wcsstr
_wcstoui64
_purecall
_vsnprintf
wcsncmp
_vscwprintf
tolower
towlower
??1type_info@@UAE@XZ
memmove
_wcsnicmp
_wtoi64
_exit
_XcptFilter
exit
_initterm
isspace
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__wgetmainargs
_vsnwprintf
__CxxFrameHandler3
wcschr
_wcsicmp
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsrchr
_wtoi
_unlock
__dllonexit
_lock
_onexit
_cexit

ntdll

RtlCreateProcessReflection
WinSqmAddToStream
WinSqmSetString
RtlFreeHeap
RtlAllocateHeap
NtSetSystemInformation
RtlAdjustPrivilege
NtQueryObject
NtSystemDebugControl
WinSqmIncrementDWORD
NtSuspendProcess
NtResumeProcess
NtQuerySystemInformation
RtlUpcaseUnicodeChar
RtlCompareMemory
ShipAssert
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
NtQueryInformationThread
NtQueryEvent
RtlImageNtHeaderEx
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtOpenEvent
NtWaitForSingleObject
NtClose
EtwEventWriteNoRegistration
RtlNtStatusToDosError
NtQueryInformationProcess
NtQueryInformationToken
EtwTraceMessage
DbgPrint

ole32

CoGetCallState
CoUninitialize
CoCreateInstance
CoInitialize
CoGetActivationState
CoGetObject
StringFromGUID2
CoSetProxyBlanket
CoTaskMemFree
ProgIDFromCLSID
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocStringLen
SysFreeString

shlwapi

ord437

imm32

ImmDisableIME

wer

WerpAddAppCompatData
WerpReportCancel
WerReportCreate
WerpSetIntegratorReportId
WerpGetReportConsent
WerpSetCallBack
WerpAddRegisteredDataToReport
WerReportSetUIOption
WerReportSubmit
WerReportCloseHandle
WerpAddFile
WerpPromtUser
WerpAddSecondaryParameter
WerReportAddDump
WerpSetEventName
WerpSetDynamicParameter
WerReportSetParameter
WerpIsTransportAvailable
WerpGetReportFlags
WerpSetReportFlags
WerpGetNumFiles
WerpGetFileByIndex
WerpCreateIntegratorReportId
WerReportAddFile
WerpFreeString

comctl32

ord410
ord412
ord345
ord413

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd21949848883f845c44aff689327590

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

shlwapi

imm32

wer

comctl32

faultrep

Sections

.text Size: 243KB - Virtual size: 243KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 20KB - Virtual size: 20KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 243KB - Virtual size: 243KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 20KB - Virtual size: 20KB

.UPX0
Size: 104KB - Virtual size: 252KB