tmpsorwnfm0

Sharing

Copy URL Twitter E-mail

General

Target
tmpsorwnfm0
Size 266KB
Sample260602-erhefaey9p
SHA256 3635f2610c7b6efae03ead46f7ed78630211f63b07b86fbb11ff3496044b21b3
MD5 3e3986b65fc4e48978e0e3b69659233e
SHA1 5c8f3a36761af58a8aa60ca2c140acf9d0af4cb7
SHA512 374b0764a7f23c07863b99ab374e56ae8e1e633b6e5a021a721d75e319e5b9fa892e9ed0ca755994e6445ce3ef42483a90461526c278d26af599a77f3cc96b49
SSDEEP 3072:uW/1lqNqAoPJl+Q7fFOPLfie9rHbK5pWsl8bnDZNnZRfs6pCWtKU7xTVKpfo5Utn:lrDPSgFCqiXIQ28bDr5trKpfo5aoo
TLSH
T1474412A7FB86C63FE0580B7064FDC22972FC66842264493B1D0474896DB7E73777AA44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpsorwnfm0

File Explorer

tmpsorwnfm0

.exe 266KB

IMPHASH 54e009db0d04ac6413ca63a9073a239c
SHA256 3635f2610c7b6efae03ead46f7ed78630211f63b07b86fbb11ff3496044b21b3
MD5 3e3986b65fc4e48978e0e3b69659233e
SHA1 5c8f3a36761af58a8aa60ca2c140acf9d0af4cb7
SHA512 374b0764a7f23c07863b99ab374e56ae8e1e633b6e5a021a721d75e319e5b9fa892e9ed0ca755994e6445ce3ef42483a90461526c278d26af599a77f3cc96b49
SSDEEP 3072:uW/1lqNqAoPJl+Q7fFOPLfie9rHbK5pWsl8bnDZNnZRfs6pCWtKU7xTVKpfo5Utn:lrDPSgFCqiXIQ28bDr5trKpfo5aoo
TLSH
T1474412A7FB86C63FE0580B7064FDC22972FC66842264493B1D0474896DB7E73777AA44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameW GetLastError GetTickCount GetCurrentProcess MultiByteToWideChar GetSystemDirectoryW GetVersionExA GetProcessHeap GetStartupInfoW SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsAlloc GetCurrentThreadId HeapCreate ExitProcess GetModuleFileNameA GetEnvironmentStringsW GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetStringTypeA GetStringTypeW Sleep GetLocaleInfoA InitializeCriticalSection LoadLibraryA BeginUpdateResourceW GetProcAddress

user32

GetSystemMetrics EnableMenuItem mouse_event PostMessageW LoadMenuIndirectA IsMenu SetCursor DestroyCursor GetMenuItemID wvsprintfA GetMenuInfo UnregisterClassA GetScrollPos FindWindowW EnableWindow GetClassInfoExA CreateAcceleratorTableW GetIconInfo keybd_event SetWindowPos CreatePopupMenu CreateMenu GetCapture SetDlgItemTextA GetDlgItemTextW EnumClipboardFormats CharLowerA GetSysColorBrush CreateDialogParamW PeekMessageA AppendMenuA MonitorFromWindow

advapi32

RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegDeleteKeyW CloseServiceHandle StartServiceW OpenServiceW OpenSCManagerW

resutils

ResUtilGetProperty ResUtilVerifyPropertyTable ResUtilVerifyResourceService ResUtilGetBinaryValue ResUtilSetPropertyParameterBlock ResUtilFindDependentDiskResourceDriveLetter ResUtilGetProperties ResUtilSetPropertyParameterBlockEx ResUtilGetPropertySize ResUtilGetAllProperties ResUtilIsResourceClassEqual ResUtilVerifyService ResUtilFindDwordProperty ResUtilGetResourceDependency ResUtilSetResourceServiceStartParameters

gdi32

CreateDIBSection GetMetaFileA CreateBrushIndirect GetRasterizerCaps AddFontResourceA UpdateICMRegKeyA GetStockObject

d3d8thk

OsThunkDdGetBltStatus OsThunkDdDestroyMoComp OsThunkDdCreateMoComp OsThunkDdGetDriverInfo OsThunkDdUnlockD3D OsThunkDdGetDxHandle OsThunkDdGetDC

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CODE

Size

3KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX0

Size

5KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

91KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

130KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

2KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpsorwnfm0

kernel32

user32

advapi32

resutils

gdi32

d3d8thk

generic