cb1df8ab6ee729c5398da59b21f03f86d302301d2178e61758c8d064a3108c07

General

Target

cb1df8ab6ee729c5398da59b21f03f86d302301d2178e61758c8d064a3108c07
Size

15.5MB
MD5

3408f15d5dfeae29b1acaf2313b5ab7f
SHA1

17556f305dac8e351808b4bf4336880a443b6323
SHA256

cb1df8ab6ee729c5398da59b21f03f86d302301d2178e61758c8d064a3108c07
SHA512

6dab7ffd808566303678fa265a69a8b9f6e619a95d7539b8a6c667d65ce3548eacb5a34c838a43950d0750dded52b3ba4d62280d1dd3b91f9385ec39b9b57464
SSDEEP

393216:deHuj9Axp/EUXRo3E+NDKy3EBUAImsI9v66+69eKnMFX2:xo/TRofK/BUfm566XkFFG

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/中兴改码开telnet.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/unate.exe
unpack001/中兴改码开telnet.exe
unpack002/out.upx

Files

cb1df8ab6ee729c5398da59b21f03f86d302301d2178e61758c8d064a3108c07
.zip
unate.exe
.exe windows:4 windows x86 arch:x86

14610dd0ebbc796a9a3a2ba2cdd24e79

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess

user32

MessageBoxW

Sections

.text
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
中兴改码开telnet.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 468KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 908KB - Virtual size: 912KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_
_dllMain_Name@12
_mainB_@8
_mainW@16
_main_@4
main
main1
main5
mainB

Sections

.text
Size: 690KB - Virtual size: 689KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

flag_dat
Size: 512B - Virtual size: 18B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 505KB - Virtual size: 504KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14610dd0ebbc796a9a3a2ba2cdd24e79

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 76KB - Virtual size: 80KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 468KB

UPX1 Size: 908KB - Virtual size: 912KB

.rsrc Size: 17KB - Virtual size: 20KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 690KB - Virtual size: 689KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 7KB - Virtual size: 17KB

flag_dat Size: 512B - Virtual size: 18B

.rsrc Size: 505KB - Virtual size: 504KB

.text
Size: 76KB - Virtual size: 80KB

UPX0
Size: - Virtual size: 468KB

UPX1
Size: 908KB - Virtual size: 912KB

.rsrc
Size: 17KB - Virtual size: 20KB

.text
Size: 690KB - Virtual size: 689KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 7KB - Virtual size: 17KB

flag_dat
Size: 512B - Virtual size: 18B

.rsrc
Size: 505KB - Virtual size: 504KB