f42cf004b43dc4cca2cc4009ae7d8e0c9de0427d485b24c57f0428a8a2004947N

Sharing

Copy URL Twitter E-mail

General

Target

f42cf004b43dc4cca2cc4009ae7d8e0c9de0427d485b24c57f0428a8a2004947N
Size

314KB
MD5

b266165c7ebefca86c6e58d760186580
SHA1

b976787c2eafaff8cffd95bd096ecbba2faec1a3
SHA256

f42cf004b43dc4cca2cc4009ae7d8e0c9de0427d485b24c57f0428a8a2004947
SHA512

dd62500a8104c747e550c0360b636ad9e64633e4d344144e159715f7dcdaf7cd1370276fd22bf99d252cad0792b1b44764a1976c2b876576b28327ad5be49b43
SSDEEP

6144:LzEluBxuGRIgqbMP7tAezgw++sC/bAfs5MJWzRVbEOfQv:kluBxuyIgqAPG0gsT

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f42cf004b43dc4cca2cc4009ae7d8e0c9de0427d485b24c57f0428a8a2004947N

Files

f42cf004b43dc4cca2cc4009ae7d8e0c9de0427d485b24c57f0428a8a2004947N
.exe windows:4 windows x86 arch:x86

1bc4eb290ab17d82b788e3d986b42167

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

?

?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

kernel32

CloseHandle
CompareStringA
CopyFileA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FindClose
FindFirstFileA
FormatMessageA
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCurrentThreadId
GetDiskFreeSpaceA
GetEnvironmentStrings
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemInfo
GetThreadLocale
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalAlloc
LocalFree
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEvent
SetFilePointer
SetHandleCount
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW

wsock32

WSACleanup
WSAStartup
closesocket
connect
gethostbyname
gethostname
htons
inet_ntoa
recv
select
send
setsockopt
socket

gdi32

BitBlt
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreatePalette
CreatePenIndirect
DeleteDC
DeleteObject
GetBrushOrgEx
GetCurrentPositionEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetObjectA
GetPaletteEntries
GetPixel
GetStockObject
GetSystemPaletteEntries
GetTextMetricsA
MaskBlt
MoveToEx
PatBlt
RealizePalette
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetROP2
SetStretchBltMode
SetTextColor
StretchBlt
UnrealizeObject

user32

CharNextA
CloseClipboard
CreateWindowExA
DefWindowProcA
DispatchMessageA
EnumThreadWindows
FillRect
FindWindowA
FindWindowExA
GetClipboardData
GetDC
GetForegroundWindow
GetKeyboardType
GetMessageA
GetSystemMetrics
GetWindowRect
GetWindowTextA
LoadIconA
LoadStringA
MessageBoxA
OpenClipboard
RegisterClassA
ReleaseDC
SendMessageA
SetClipboardViewer
TranslateMessage
wsprintfA
GetSysColor

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VarBoolFromStr
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarCyFromStr
VarDateFromStr
VarI4FromStr
VarNeg
VarNot
VarR8FromStr
VariantChangeTypeEx
VariantClear
VariantCopy
VariantCopyInd
VariantInit

Exports

Exports

__GetExceptDLLinfo
___CPPdebugHook

Sections

UPX0
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 119KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SCY
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1bc4eb290ab17d82b788e3d986b42167

Headers

File Characteristics

Imports

?

advapi32

kernel32

wsock32

gdi32

user32

ole32

oleaut32

Exports

Exports

Sections

UPX0 Size: 184KB - Virtual size: 184KB

UPX1 Size: 119KB - Virtual size: 120KB

.rsrc Size: 1024B - Virtual size: 4KB

.SCY Size: 9KB - Virtual size: 12KB

UPX0
Size: 184KB - Virtual size: 184KB

UPX1
Size: 119KB - Virtual size: 120KB

.rsrc
Size: 1024B - Virtual size: 4KB

.SCY
Size: 9KB - Virtual size: 12KB