tmpd0h5umrm

Sharing

Copy URL Twitter E-mail

General

Target
tmpd0h5umrm
Size 259KB
Sample260602-gf2eaafx7j
SHA256 fc1c3c5b9dfec5fcb32497fb7b6cf019c4eca42b4067e653f8c953298c7cc968
MD5 98414f6e4ce2dbb1dee6167cd0d8c53e
SHA1 812308f2816e2dedd6b79db114e5b6bd701522f5
SHA512 d42e0a69e9c74f1d5195d389b1a9cd924a5402d663f863756f26778455db11529c172d6f993bf9ee15414a8473c3b46f4a2842bfcf010a8648bdff5c71affe1b
SSDEEP 6144:4TWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:2XoImYuzheQWZAZ
TLSH
T1B7442360D9CB524DD0730E740CE31D2829AE8978192F95A7A71A2455CB73708FBFEFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpd0h5umrm

File Explorer

tmpd0h5umrm

.exe 259KB

IMPHASH 0fee85a1ecfb1030eb55b9e28b61941d
SHA256 fc1c3c5b9dfec5fcb32497fb7b6cf019c4eca42b4067e653f8c953298c7cc968
MD5 98414f6e4ce2dbb1dee6167cd0d8c53e
SHA1 812308f2816e2dedd6b79db114e5b6bd701522f5
SHA512 d42e0a69e9c74f1d5195d389b1a9cd924a5402d663f863756f26778455db11529c172d6f993bf9ee15414a8473c3b46f4a2842bfcf010a8648bdff5c71affe1b
SSDEEP 6144:4TWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:2XoImYuzheQWZAZ
TLSH
T1B7442360D9CB524DD0730E740CE31D2829AE8978192F95A7A71A2455CB73708FBFEFA4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameW GetLastError GetTickCount GetCurrentProcess MultiByteToWideChar GetSystemDirectoryW GetVersionExA GetProcessHeap GetStartupInfoW SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsAlloc GetCurrentThreadId HeapCreate ExitProcess GetModuleFileNameA GetEnvironmentStringsW GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetStringTypeA GetStringTypeW Sleep GetLocaleInfoA InitializeCriticalSection LoadLibraryA GetProcAddress

user32

GetSystemMetrics LoadMenuIndirectA GetDlgItemTextA TrackPopupMenu RegisterClassW GetKeyboardType SetCursor IsMenu RegisterWindowMessageA InvalidateRect SendDlgItemMessageW CharLowerW wsprintfA GetDlgItemInt WinHelpW MessageBoxW DialogBoxParamW LoadBitmapW GetSubMenu DialogBoxIndirectParamW GetMenuItemInfoA GetIconInfo ShowCursor wvsprintfW EmptyClipboard InvalidateRgn CheckMenuItem

advapi32

RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegDeleteKeyW CloseServiceHandle StartServiceW OpenServiceW OpenSCManagerW

mssip32

CryptSIPGetSignedDataMsg CryptSIPGetRegWorkingFlags

gdi32

DeleteObject CreateICA CreateDIBPatternBrush GetEnhMetaFileW GetEnhMetaFileA SetMetaFileBitsEx CreateScalableFontResourceA CreateFontW CreatePen CreateCompatibleDC GdiGetBatchLimit AddFontResourceA CreateRectRgn CreatePatternBrush CreateDIBPatternBrushPt

filemgmt

DllGetClassObject DllCanUnloadNow DllRegisterServer CacheSettingsDlg

Name

UPX1

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

5KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

75KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.RvaZz

Size

5KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

138KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

559KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.WurWBH

Size

3KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpd0h5umrm

kernel32

user32

advapi32

mssip32

gdi32

filemgmt

generic