tmp6683ehpa

Sharing

Copy URL Twitter E-mail

General

Target
tmp6683ehpa
Size 268KB
Sample260602-e1bcgsdx4y
SHA256 0c33a2df6ecf94c0be071ae7fc8e731f4c127b0b19da968f244eddd484240457
MD5 270b419c207727751aaa2e27412ff859
SHA1 9eea0b891065ec38b5031b7bf54d84584e8c4480
SHA512 614d0f28df24411f3a9149b0f427d8f4f18ab472be59b6d03b1f3a12a7c4c7602694c85cffbc43113aad3c7faf6977e09b5f720c80b09afff53a793520619b97
SSDEEP 6144:L5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:HATkKbbxI9CEHFJzCCsCfYWivpvN20T
TLSH
T1D74412117F8A25E3C4280174E4ADFCB431BD14A7B78319379B88A37FBCF32445A69A65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp6683ehpa

File Explorer

tmp6683ehpa

.exe 268KB

IMPHASH 3039a04ea8ae6568d1f1f38e4ea28e48
SHA256 0c33a2df6ecf94c0be071ae7fc8e731f4c127b0b19da968f244eddd484240457
MD5 270b419c207727751aaa2e27412ff859
SHA1 9eea0b891065ec38b5031b7bf54d84584e8c4480
SHA512 614d0f28df24411f3a9149b0f427d8f4f18ab472be59b6d03b1f3a12a7c4c7602694c85cffbc43113aad3c7faf6977e09b5f720c80b09afff53a793520619b97
SSDEEP 6144:L5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:HATkKbbxI9CEHFJzCCsCfYWivpvN20T
TLSH
T1D74412117F8A25E3C4280174E4ADFCB431BD14A7B78319379B88A37FBCF32445A69A65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CertOIDToAlgId CryptMsgOpenToDecode CertDuplicateCertificateContext CryptMsgGetParam CertEnumCertificatesInStore CertDuplicateStore CryptMsgUpdate CertGetNameStringA CertCloseStore CertCompareCertificateName CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CryptDecodeObject CryptMsgClose

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData

kernel32

GetLastError GetModuleHandleA GetModuleFileNameW MoveFileW MoveFileA GetModuleFileNameA MultiByteToWideChar WaitForSingleObject CreateSemaphoreA SetEvent CreateEventA GetSystemTime FreeLibrary InitializeCriticalSection LoadLibraryA GetExitCodeThread WaitForMultipleObjects GetVersionExA GetCurrentThreadId LoadResource Sleep GetSystemInfo RaiseException ExitProcess GetCurrentProcess HeapCreate IsBadWritePtr TlsAlloc GetStartupInfoA GetEnvironmentStringsW SetUnhandledExceptionFilter GetACP GetOEMCP GetCPInfo IsBadReadPtr IsBadCodePtr QueryPerformanceCounter GetTickCount GetCurrentProcessId GetLocaleInfoA GetStringTypeA GetStringTypeW lstrcmpA GetProcAddress

user32

CharUpperA

advapi32

RegSetValueExA CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptHashData RegQueryValueExA RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA RegEnumKeyA RegCloseKey CryptGetHashParam

ole32

StringFromCLSID

scecli

SceStartTransaction SceRegisterRegValues SceAddToNameList DllUnregisterServer SceDcPromoCreateGPOsInSysvolEx SceGetServerProductType

kbdkaz

KbdLayerDescriptor

Name

UPX0

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.kREZn

Size

4KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

91KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ocUcy

Size

512B

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.XtjX

Size

2KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

131KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xQ

Size

5KB

Virtual Size

793KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp6683ehpa

crypt32

wintrust

kernel32

user32

advapi32

ole32

scecli

kbdkaz

generic