489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c

Sharing

Copy URL Twitter E-mail

General

Target
489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c
Size 2.0MB
Sample261024-jalsragw2x
SHA256 489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c
MD5 6bfb32dc9465a3bbfc1fedae8811e0ea
SHA1 7da886830acd7edcc30d7e5d47d17ce3bedd51d2
SHA512 7ff1dd0b66e61824bb9a11ae78e62ff9bfc62a33faed5fb2ab298f5fd2dfb70806dcae03c7523a6575e7dffe7c65a578b24e24521d3acd7e28bb347d6703f726
SSDEEP 24576:CSbA3sqjnhMgeiCl7G0nehbGZpbD63Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:CTLDmg27RnWGji4c47z+GCXm8mz3jwhn
TLSH
T181A5222AB6982064C15DC0B845EAF182E3703D105F2863DF66F29B9DCF739E40EBD661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c

File Explorer

489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c

.exe 2.0MB

489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c

IMPHASH f41dfc1f895bc78a8f70db040b014514
SHA256 489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c
MD5 6bfb32dc9465a3bbfc1fedae8811e0ea
SHA1 7da886830acd7edcc30d7e5d47d17ce3bedd51d2
SHA512 7ff1dd0b66e61824bb9a11ae78e62ff9bfc62a33faed5fb2ab298f5fd2dfb70806dcae03c7523a6575e7dffe7c65a578b24e24521d3acd7e28bb347d6703f726
SSDEEP 24576:CSbA3sqjnhMgeiCl7G0nehbGZpbD63Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:CTLDmg27RnWGji4c47z+GCXm8mz3jwhn
TLSH
T181A5222AB6982064C15DC0B845EAF182E3703D105F2863DF66F29B9DCF739E40EBD661
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\PDR_Autobuild_Trunk\GpgpuUtility\Generic\Trunk\x64\Release\GPUUtilityEx.pdb

d2d1

ord1

dxva2

DXVA2CreateVideoService

shlwapi

SHDeleteKeyW

kernel32

GetProcAddress GetEnvironmentVariableW SetEnvironmentVariableW GetModuleFileNameW lstrlenW InitializeCriticalSection DeleteCriticalSection GetLastError GetModuleHandleA EncodePointer SetDllDirectoryW SetLastError LocalFree SwitchToThread SetErrorMode QueryPerformanceCounter IsProcessorFeaturePresent LoadLibraryW FreeLibrary GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime IsDebuggerPresent DecodePointer LoadLibraryA CloseHandle

user32

GetDesktopWindow

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegEnumKeyExW

ole32

CoSetProxyBlanket CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

msvcp110

?_Winerror_map@std@@YAPEBDH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z

msvcr110

_cexit _configthreadlocale __setusermatherr _initterm_e _initterm _wcmdln _fmode _commode strcmp ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crtSetUnhandledExceptionFilter memcmp memcpy ?terminate@@YAXXZ memmove _purecall ??3@YAXPEAX@Z ??2@YAPEAX_K@Z swprintf_s ??_V@YAXPEAX@Z wcscpy_s _wsplitpath_s wcscat_s _stricmp free towlower malloc memchr strcpy_s toupper wcsncpy_s vswprintf_s swscanf_s _CxxThrowException memset __CxxFrameHandler3 _lock _unlock _calloc_crt __dllonexit __C_specific_handler _onexit __crt_debugger_hook __crtUnhandledException __crtTerminateProcess __crtCapturePreviousContext _XcptFilter __crtGetShowWindowMode _amsg_exit __wgetmainargs __set_app_type exit _exit

winmm

timeGetTime

d3d11

D3D11CreateDevice

Name

.text

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

489692d965aecfc0477b76e1a262e8120c5becde14ce886a6d27ca27927b339c

d2d1

dxva2

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

msvcp110

msvcr110

winmm

d3d11

generic