3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73

Sharing

Copy URL Twitter E-mail

General

Target
3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73
Size 1.9MB
Sample261027-kf4fescw8k
SHA256 3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73
MD5 39331366af8523b3bbca2e7f087034b9
SHA1 1cfe8cade39cbbd34d1648f87ab09ce9281e09fc
SHA512 9711657b8000fec82fbcb5159984882afc427a0bb0e25c51a672087f3115d8988f2a7177c3a0c589451c3debdb256c0951e57b8ddf14af6b0ed6df445d64cb5a
SSDEEP 24576:6p0O5vZJlatUtDekfxntw0si7reQWm3JxBEu2wncUpNdh1kmZeFkMkIt+:e/b6kfxn+i7reQWIBEu2WXh1zZktj+
TLSH
T1F595BE2076B2C832D36202B35B69AB1941687D741B22C9D7F3D73E1D59726C29B3723B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73

File Explorer

3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73

.exe 1.9MB

3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73

IMPHASH 474730d0f4c4c0df20c4706052a39738
SHA256 3bdb9fdcf400b4aa740f0dcd87a94b02afecc42987de24bfbed780e89cc5cc73
MD5 39331366af8523b3bbca2e7f087034b9
SHA1 1cfe8cade39cbbd34d1648f87ab09ce9281e09fc
SHA512 9711657b8000fec82fbcb5159984882afc427a0bb0e25c51a672087f3115d8988f2a7177c3a0c589451c3debdb256c0951e57b8ddf14af6b0ed6df445d64cb5a
SSDEEP 24576:6p0O5vZJlatUtDekfxntw0si7reQWm3JxBEu2wncUpNdh1kmZeFkMkIt+:e/b6kfxn+i7reQWIBEu2WXh1zZktj+
TLSH
T1F595BE2076B2C832D36202B35B69AB1941687D741B22C9D7F3D73E1D59726C29B3723B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

675134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\build\workspace\miflash_git\out\Release\bin\miflash_unlock.pdb

kernel32

AssignProcessToJobObject GetUserDefaultLangID ResumeThread GetExitCodeProcess GetWindowsDirectoryW TerminateThread GetExitCodeThread ExitThread DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetSystemDefaultLangID WideCharToMultiByte MultiByteToWideChar InterlockedExchangeAdd SetUnhandledExceptionFilter GetTempFileNameW GetCurrentProcess CreateDirectoryW WriteFile CopyFileW GetFileAttributesW CreateFileW GetTempPathW GetLongPathNameW SetLastError RemoveDirectoryW GetFileAttributesExW DeleteFileW WaitForSingleObject SetEvent SystemTimeToTzSpecificLocalTime SystemTimeToFileTime QueryPerformanceCounter InterlockedCompareExchange SetCurrentDirectoryW FileTimeToSystemTime QueryPerformanceFrequency GetCurrentThread Sleep IsDebuggerPresent GetCurrentThreadId DuplicateHandle CreateThread TlsGetValue TlsSetValue TlsAlloc TlsFree CreateMutexW SetFilePointer CreateProcessW GetTickCount ReleaseMutex GetCurrentProcessId GetQueuedCompletionStatus InterlockedExchange PostQueuedCompletionStatus CreateIoCompletionPort SetEndOfFile SetFilePointerEx SetFileTime FlushFileBuffers GetNativeSystemInfo GetModuleHandleW GetVersionExW GetProcAddress LeaveCriticalSection EnterCriticalSection GetModuleHandleExW GetCommandLineW InterlockedIncrement GetModuleHandleExA LoadLibraryW GetACP FreeResource LockResource ExitProcess LoadResource SizeofResource FindResourceW GetFileSize MulDiv GetFileType DosDateTimeToFileTime GetLocalTime InterlockedDecrement GlobalAlloc GlobalLock GlobalUnlock GetPrivateProfileStringW HeapAlloc GetProcessHeap HeapFree FreeLibrary OutputDebugStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess GetTimeZoneInformation GetUserDefaultLocaleName VerSetConditionMask VerifyVersionInfoW IsWow64Process SetFileAttributesW GetDriveTypeW GetSystemDirectoryW CreatePipe SetHandleInformation PeekNamedPipe lstrcmpiW GetComputerNameW EncodePointer GetStringTypeW IsProcessorFeaturePresent GetFullPathNameW GetConsoleCP GetConsoleMode HeapReAlloc SetStdHandle AreFileApisANSI RtlUnwind ReadConsoleW GetCPInfo UnhandledExceptionFilter GetStartupInfoW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP HeapSize GetStdHandle WriteConsoleW SetEnvironmentVariableA GetCurrentDirectoryW GetLastError CreateEventW ReadFile CloseHandle ConnectNamedPipe CreateNamedPipeW GetSystemTimeAsFileTime GetModuleFileNameW

user32

GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetDesktopWindow GetLastActivePopup SetForegroundWindow RegisterDeviceNotificationW TranslateMessage RegisterClassExW CallMsgFilterW PeekMessageW MsgWaitForMultipleObjectsEx CreateWindowExW DefWindowProcW DispatchMessageW GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret SetRect FillRect DrawTextW CharPrevW GetWindowRgn MoveWindow LoadImageW PostMessageW IsWindowVisible SetWindowLongW WaitMessage GetWindowTextW PostQuitMessage SetTimer GetWindowLongW UnregisterClassW MessageBoxW DestroyWindow GetMessageW SendMessageW GetPropW SetPropW GetSystemMetrics EnableWindow ShowWindow GetClassInfoExW RegisterClassW CallWindowProcW GetMonitorInfoW MonitorFromWindow SetWindowRgn IsZoomed LoadCursorW OffsetRect SetCursor wvsprintfW GetWindow GetParent PtInRect IsRectEmpty UnionRect IntersectRect MapWindowPoints ScreenToClient SetWindowTextW GetSysColor KillTimer ClientToScreen GetCursorPos GetWindowRect GetClientRect InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetFocus CharNextW IsIconic SetWindowPos IsWindow GetQueueStatus

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW SHGetFolderPathW

oleaut32

SysAllocString VariantInit VariantClear VarUI4FromStr SysFreeString

dbghelp

MiniDumpWriteDump

rpcrt4

UuidFromStringW

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItem GdipGetPropertyItemSize

vmprotectsdk32

VMProtectBeginUltra VMProtectEnd

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

winmm

timeGetTime timeBeginPeriod timeEndPeriod

iphlpapi

GetAdaptersInfo

setupapi

CM_Get_Sibling_Ex CM_Get_Device_ID_ExW CM_Connect_MachineW CM_Get_Child_Ex CM_Disconnect_Machine CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status_Ex SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo CM_Locate_DevNode_ExW

comctl32

ord17 _TrackMouseEvent

gdi32

GetClipBox GetCharABCWidthsW CreateSolidBrush CreatePenIndirect CombineRgn GetObjectA CreateDIBSection PtInRegion CreateRectRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC CreateCompatibleBitmap Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateRectRgnIndirect BitBlt CreatePatternBrush GetDeviceCaps GdiFlush ExtTextOutW TextOutW MoveToEx SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W

advapi32

RegOpenKeyExW RegCloseKey RegDeleteKeyW RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW CreateProcessAsUserW RegEnumKeyExW RegSetValueExW IsTextUnicode

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoInitialize CoInitializeEx CoUninitialize

libcurl

curl_free curl_easy_escape curl_global_init curl_slist_free_all curl_easy_cleanup curl_easy_getinfo curl_easy_perform curl_easy_setopt curl_easy_init curl_slist_append

libeay32

ord276 ord2656 ord266 ord3067 ord2660 ord3313 ord3315 ord333 ord3314 ord3312 ord332 ord2747 ord2572 ord964 ord965 ord2784 ord264 ord2927 ord260 ord502 ord504 ord256 ord503 ord323 ord961 ord2894 ord294 ord501

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

855KB

Virtual Size

855KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

807KB

Virtual Size

808KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=199, version=41118,

count=42, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=87, id=225, productName=VS2013 build 21005, version=21005,

count=255, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=225, version=20806,

count=6, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=34, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=536, id=1, productName=Unmarked objects,

count=156, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,