786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a

Sharing

Copy URL Twitter E-mail

General

Target
786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a
Size 5.5MB
Sample260916-npgvkazckb
SHA256 786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a
MD5 1a1a0f0a3fedb641ec150556a7fadaec
SHA1 60ae0eab5d143b6c5246efac5a0162914a34f1df
SHA512 8b7cad1a14bb00c495766808b46f9797fcb2b93acff9ba82ceae25ff6abb02ee069c6a9bd6b9b9eadd15e036435973b2df1a64264c5d12808ffdd86d7450f847
SSDEEP 98304:zsnRcCzvaU7KPT9aNmcz4gwiexiyRuMqXY+ILH61Ft0nEr4Yj7ZDu4iqc:gc7UG9ghwimiSmkskE/j0f
TLSH
T10446127323610058D0D6CC368537BDEA72F6136BCB42ACFB59C92DC525326E5A633A93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a

File Explorer

786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a

.dll 5.5MB

786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a

IMPHASH 2c7f12e07c9ab4c2d34702b86ceb0bea
SHA256 786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a
MD5 1a1a0f0a3fedb641ec150556a7fadaec
SHA1 60ae0eab5d143b6c5246efac5a0162914a34f1df
SHA512 8b7cad1a14bb00c495766808b46f9797fcb2b93acff9ba82ceae25ff6abb02ee069c6a9bd6b9b9eadd15e036435973b2df1a64264c5d12808ffdd86d7450f847
SSDEEP 98304:zsnRcCzvaU7KPT9aNmcz4gwiexiyRuMqXY+ILH61Ft0nEr4Yj7ZDu4iqc:gc7UG9ghwimiSmkskE/j0f
TLSH
T10446127323610058D0D6CC368537BDEA72F6136BCB42ACFB59C92DC525326E5A633A93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4814018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

InterlockedCompareExchange FreeLibrary GetProcAddress VirtualProtect HeapAlloc HeapFree HeapValidate GetProcessHeap GetCurrentProcess TerminateProcess CreateThread Sleep LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GlobalMemoryStatusEx DeviceIoControl CloseHandle GetWindowsDirectoryA CreateFileA GetVolumeInformationA CreateFileW WriteConsoleW InterlockedExchange SetStdHandle SetFilePointerEx LoadLibraryW LoadLibraryExW OutputDebugStringW HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId GetModuleFileNameA GetFileType GetConsoleMode GetConsoleCP GetOEMCP GetACP IsValidCodePage HeapSize GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile FlushFileBuffers InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte MultiByteToWideChar GetStringTypeW RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime GetLastError GetCommandLineA GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW GetStdHandle GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

DispatchMessageA PeekMessageA MessageBoxTimeoutA TranslateMessage CharUpperBuffW

ws2_32

setsockopt send select shutdown ioctlsocket connect closesocket socket WSAStartup WSACloseEvent WSAEnumNetworkEvents WSACreateEvent WSAEventSelect WSAWaitForMultipleEvents getaddrinfo freeaddrinfo recv

iphlpapi

GetAdaptersInfo

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.UPX0

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.UPX1

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.UPX2

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

786d5b1ec67ab132d9a11d8aa3f31038ba269ddead9573eea9ab5178aaea697a

kernel32

user32

ws2_32

iphlpapi

generic