tmp1oc9act9

Sharing

Copy URL Twitter E-mail

General

Target
tmp1oc9act9
Size 266KB
Sample260602-ewpdjsdw9w
SHA256 9b47c743ebc600ce33303b748af5daaef8bb9bd2fb255aa38dd3f7270df0de38
MD5 2f463779c39b729439ed161b49d84120
SHA1 50666fe1be382b8d89beb6d0985cbb456f3ea41c
SHA512 de59c7786ec1bddc0c7eec43da2db77d0c19357558cd06853890cfe682e5d08767ee5840369cf53fc0bb8be18d826e4d901d4af6d6c0700ae5049b0885679f4d
SSDEEP 3072:hW/1lqNqAoPJl+Q7fFOPLfie9rHbK5pWsl8bnDZNnZRfs6pCWtKU7xTVKpfo5Utn:0rDPSgFCqiXIQ28bDr5trKpfo5aoo
TLSH
T14E4412A7FB86C63FE0580B7064FDC22972FC66842264493B1D0474896DB7E73777AA44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp1oc9act9

File Explorer

tmp1oc9act9

.exe 266KB

IMPHASH 54e009db0d04ac6413ca63a9073a239c
SHA256 9b47c743ebc600ce33303b748af5daaef8bb9bd2fb255aa38dd3f7270df0de38
MD5 2f463779c39b729439ed161b49d84120
SHA1 50666fe1be382b8d89beb6d0985cbb456f3ea41c
SHA512 de59c7786ec1bddc0c7eec43da2db77d0c19357558cd06853890cfe682e5d08767ee5840369cf53fc0bb8be18d826e4d901d4af6d6c0700ae5049b0885679f4d
SSDEEP 3072:hW/1lqNqAoPJl+Q7fFOPLfie9rHbK5pWsl8bnDZNnZRfs6pCWtKU7xTVKpfo5Utn:0rDPSgFCqiXIQ28bDr5trKpfo5aoo
TLSH
T14E4412A7FB86C63FE0580B7064FDC22972FC66842264493B1D0474896DB7E73777AA44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameW GetLastError GetTickCount GetCurrentProcess MultiByteToWideChar GetSystemDirectoryW GetVersionExA GetProcessHeap GetStartupInfoW SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsAlloc GetCurrentThreadId HeapCreate ExitProcess GetModuleFileNameA GetEnvironmentStringsW GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetStringTypeA GetStringTypeW Sleep GetLocaleInfoA InitializeCriticalSection LoadLibraryA BeginUpdateResourceW GetProcAddress

user32

GetSystemMetrics EnableMenuItem mouse_event PostMessageW LoadMenuIndirectA IsMenu SetCursor DestroyCursor GetMenuItemID wvsprintfA GetMenuInfo UnregisterClassA GetScrollPos FindWindowW EnableWindow GetClassInfoExA CreateAcceleratorTableW GetIconInfo keybd_event SetWindowPos CreatePopupMenu CreateMenu GetCapture SetDlgItemTextA GetDlgItemTextW EnumClipboardFormats CharLowerA GetSysColorBrush CreateDialogParamW PeekMessageA AppendMenuA MonitorFromWindow

advapi32

RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegDeleteKeyW CloseServiceHandle StartServiceW OpenServiceW OpenSCManagerW

resutils

ResUtilGetProperty ResUtilVerifyPropertyTable ResUtilVerifyResourceService ResUtilGetBinaryValue ResUtilSetPropertyParameterBlock ResUtilFindDependentDiskResourceDriveLetter ResUtilGetProperties ResUtilSetPropertyParameterBlockEx ResUtilGetPropertySize ResUtilGetAllProperties ResUtilIsResourceClassEqual ResUtilVerifyService ResUtilFindDwordProperty ResUtilGetResourceDependency ResUtilSetResourceServiceStartParameters

gdi32

CreateDIBSection GetMetaFileA CreateBrushIndirect GetRasterizerCaps AddFontResourceA UpdateICMRegKeyA GetStockObject

d3d8thk

OsThunkDdGetBltStatus OsThunkDdDestroyMoComp OsThunkDdCreateMoComp OsThunkDdGetDriverInfo OsThunkDdUnlockD3D OsThunkDdGetDxHandle OsThunkDdGetDC

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CODE

Size

3KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX0

Size

5KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

91KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

130KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

2KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp1oc9act9

kernel32

user32

advapi32

resutils

gdi32

d3d8thk

generic