f557f7582ff39d6120b350f5beeed2f7b440aee68a7f73b845c336084ae7a34d

resource	yara_rule
sample	upx

resource
f557f7582ff39d6120b350f5beeed2f7b440aee68a7f73b845c336084ae7a34d

IMPHASH b20766eacc7e67642095a497e21957e2
SHA256 f557f7582ff39d6120b350f5beeed2f7b440aee68a7f73b845c336084ae7a34d
MD5 39d7ddd4b6790f3f27fa4ab4cc0afb31
SHA1 6bbf04259c125f7eb1e97e318ac556e5421a202c
SHA512 1b945e7b70a1c713717dc478d34397cf59d5b4a4808f942422cd89d61f10fb50547c78ce56f4260ccbf5c5c69beb41fdf42f8edc99dd1c995e3eb5502690e6ea
SSDEEP 12288:11z+tueLHbjL8KjGwxaRT9gAezVqG50o:11zfC7MKjTxeT9MzMK0o
TLSH
T1F1B5C0D6A588E522CD2516B019E7BDBA0331AF086EF1D7AD3A6D765E37337C29037102
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW RegEnumKeyW

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create ord17

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SetBkMode

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW CloseHandle CloseHandle GetCommandLineW CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LocalFree CloseHandle LoadLibraryA ExitProcess GetProcAddress VirtualProtect

kernelbase

WideCharToMultiByte GetTickCount Sleep ExpandEnvironmentStringsW MultiByteToWideChar

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW SHGetFileInfoW

user32

GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics GetDC

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree OleInitialize

.idata

SHA256 b756e7b900a525694cbd46a718992d7c8cdb2cb7d5dafe3c0d977749cd0ce851
MD5 a4a12fb5da5788ca99c86642b0bf9867
SHA1 5e6d2f436d97c2d1b1be2251284ea6df97ef05df
SHA512 c16ee6626ea185e3662e1fe32f442ffec8bd8f296ed9fa04990dacc57de7673bf592afda78b1821430ff120701a3cfd30b1b56864be302024dd724ac0fc9a825
SSDEEP 96:FlF8GyOjHv+/7divG5q2gG0fGloQgIrMvGxiCCUrkWE5fdGAQAI:FlGODvSdQG5q2t0JAg2iCCSOfdGII
TLSH
T15EB11FEF295C0BD2EFA12B393451A50B8F96B462042D8874068472DF5F6B3E6022C7F6
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/GROUP_ICON/103

SHA256 f9fdbe9d5dedff714663b8dd1948f775db50503088700854b3f3ff3b87c5f2ac
MD5 53a8be58749cb32283e951bb501860ff
SHA1 bdce14cf658668a6a7c9a54c6f7be239342b5fdc
SHA512 a173e301dfe51e0013e60690626af6b67a98ab39036ebfe96ccbbddb4f3857cd34126fb148a8eee094ef1d0e8108da12ec05f0036221016d945556936a23980c
TLSH
T1E5D001559B599A0CD2F14BBD4C5A0727402DD4DA02A22643026F45A87C032B956B9B24
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/1.ico

SHA256 868388fe6d84d5ef40928ee5ca4066ea76f0516c163783d68163996adb9149bf
MD5 73e1ab42db9de23d23995d529fd11057
SHA1 5fe050c368c132e8be02f79779eec8722e58f5a7
SHA512 8f0111586e9572000b47031a4b1c6ff89d2ee5bd78e292b61ff9f18566deb56bb1355b5180f96d022522f2b215c11b5a9f11841a6a31731d36c74b1154588a5f
SSDEEP 3072:a+zGAuejPv/0+brLOyBLGXvfSfdOjBsDNGgPRD12lCpWxRj:a+tuejPv/vbPbL8vClDNGwR5zpaRj
TLSH
T1D9E312D8B55F8526E033E434941754C0A6A97B12CCF4A9BCBA80302BD79F56BB4F1CA9
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/10.ico

SHA256 28f344bdc5a534427d5f126ba70e12e8698fda405b5d92ca60a639a4047f8b7e
MD5 5b8e8d2c857a020ecad98cb220a92f6b
SHA1 8ad5d575f27cb5dcc770f34dfbc2417bc73dee66
SHA512 476f1567a9b83c796f5da07a263ff2860d9976b9c2b034e99c2c5ded46d342d452c4f60706bdca1c7e8d963cb4aaea1f5effa10eaf43caf19bfea49f90e0a218
SSDEEP 96:kqHBh16RLq7OCtOpaab0Xu6sz6t7+Tph36OnuKJJa:k4uLq7OCtORb0XuJpTph3PzU
TLSH
T139E1E9839849E651CC590C701CE75EBA57217C098F71CB5E27FF3AA2BD336C695B2406
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/11.ico

SHA256 01c18928fc2fe1b3bffc83e7a405f4f7ffb329e509b04d433ed794388e28783b
MD5 10e063c1ff96f69bd3a9a04c8d164351
SHA1 0206a8907d50b138713cc061bcf7f28c676aa454
SHA512 4e07c756dd9fd7f7b8549cb43781941edf06fd5ee4cec9401569bb0b45f0b048f87afb7b06cde0f4cb2fb9e276f10a576afda05ea47f454da488f9f3e4832eb9
SSDEEP 48:NHrUL9MRN6ku203JGNBgPr2S9FIduuqmpaxQUyCN6tAQert1w8Rw8kMmn3Niiq8:NAMok50SITsdHpuNjrtY1
TLSH
T1FD9119829105B81BD98446F2D6C76BE91236DD05ED35FF954A3F3AA10B333C26673006
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/12.ico

SHA256 efe9edc4d3f53abdd4ac320dc2e0fdb941d1340356b1fb18964036be358ee8ef
MD5 62ace4fcc28d4192775d4834811efddc
SHA1 24b63bc014ce0a9b4b108a0a06e9de6324777ff7
SHA512 6b09d78bd6f19a30734b165252bd9840dbb6c0edb05b4fb6ebdee5a55a421580f56ed8495796a764ef3b1ca6ffac611a1e33d9dcd164cb289ca4859276c6cfeb
TLSH
T11651C42389027A20C849563985C60AA51164AE8D3036EFFD4EBEB8A02E733D5AB37061
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/13.ico

SHA256 1bc1d513846ade2c334030c7befcc6cdcb759955e475af38e551bf1cf543a3b7
MD5 ddc8d1c0b5957ba3905acec798ffe5cf
SHA1 9b2b6cd72aa13603f87d4fd8745b2fb3b6ab125c
SHA512 0f738d76b4719363a8afbcad76cd4ed0f048db6d30ef54060a31cdd40176c0c64e95f3612984fcb7e1c41ccddcee0ce61b37ccb707fa99f50ab41911dce6efca
TLSH
T1003192D3A5042136EC68B63720925B4A0A3FEE1D219DDD93628970605B3B76FE13E522
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/14.ico

SHA256 75a075402fe02a933a2f2a008e855c80b0a72ddbdd162a56fc6709e340217331
MD5 08b0e5f8c4aea9d5c48f10dfc612af57
SHA1 27e99b8f89327f886f863ab4f9928d894d7654a5
SHA512 99f0c2570923fc9a581164287b6c948f7735529eb705c0f504281f9c2398bfc3411221c7243c0cfc2a5bca6dc2cfb8835a5a969705c6fd9f79570de2a4f3c3d6
TLSH
T19621634AE195F91CF51C06B0E9531928A120EA1B3007832B3A50B6DD0CC368B28FA916
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/2.ico

SHA256 c4accff6186042bb96d6dbcc2303463b301c740e085f04197dbfd6589faafbfc
MD5 904ca650e691c5f7e30a94edda6630ec
SHA1 588ec2e218690fade6e703350a2f261145c1deeb
SHA512 5463283405e55d7718423f67298b5c99dcc01f1f49b315abac00769d0568874dc6a9f98acfcec148c03a51e094e33d50f3378729c57aa1b1cd9562f50a1c4475
SSDEEP 768:HOhP9qvf8bsIyrgwznAeMIazsM58aeEWgnlqxj:HOV9qvf8bsIyrgwznuvzsM5AEW5
TLSH
T1D763C5E6A584E16ACF2914B059D7BDF30371AF4C69A393A1757CB7AA2037BC1D133112
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/3.ico

SHA256 e72d265161066f3a4c3888c95527593edbca3def7f2f4a49eb080d162fdc4882
MD5 19053bbea0e1b9615538c94883adb78e
SHA1 d62e3d14bc98a7f2221de5bc06ad214d41890bd4
SHA512 62706ba5cfa02412c6820be2af1327f079dc82bdb62c7ee586117cd920b9a8fef54ab46e7967072664cec0bcbf9eb715fd709d6c6e097b8f30345ae66e0058c3
SSDEEP 768:D/kV8Nx0ny5ByYhqvQ/OSQr5mmfcGzAOqPLx3zJtceGutCoaj:T+8NxkyfyY4AOSQr5mmfcJx3zJcu2j
TLSH
T13313F1BF1099B5E6CC071AF41DCF0E3AD96C943C7B7C2A2527B6607CD8CA1E944899D2
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/4.ico

SHA256 86c10ccc299e638cd572247f3c4eff853555b15b4a044e7ac67c112e9ac9cf8e
MD5 8f14ced0f949beb63b56ed4aac9bbf7f
SHA1 0251b7202866466036e40654c531c47e02ffed17
SHA512 c276b1ea836c4adfbdc6f5dd325efb79bd1c0954c1a46cd414e57bb45b0e7f139ac569628e93278fc294ddc24f306c023e985535bb5548a77c7d771787f4b197
SSDEEP 384:2ixIPe4sUoCdFhMkDxMibIW01XWGXXmagx5YdgDKQvhpiyKkb7rZeIhHhmH:Tx9xCdzMykz4ooNvDiI1Nu
TLSH
T1D903D9C7E5489511CE6D1BB059AAAD9E03215E483FF2D2AE3A3F760A33737D2A172411
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/5.ico

SHA256 617e7b0403939081698de380292dabbcc3744dd9f9d7236665bb9fa07d47c5e2
MD5 65723c4d131fb3b5baac9fa21b160e2f
SHA1 6b37f057f9cee4518ecabfe593f5e5e5b6a1a851
SHA512 1c5565329f611af07b160aa76982b3c6ed7ab453825017a6096b4bab3fd6814ba3c85f0a56ee46720fc79eff115e2adfd15ea1eb8a35c3b34d3f02abfc56b9ea
SSDEEP 192:xaTiTrjYmGDuQkQXPzp8M9vdLQ/OFudeoqZzwma9IXl8MCe12OTn07JQm:xaefYmGDlkQXPzpZLLrsk0K07JR
TLSH
T12EC2D7E6A1C87906CC9925F0D57BADAE07319FCC1AB2D1EE394EB61636337D2A073101
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/6.ico

SHA256 2403a479d577a60718d732fc9f9bec2aa8964e0fbd2467035e4ce2388012d687
MD5 067d812ed99493e9eda02d7eb594d699
SHA1 7ae63c1a8bb9bd93899f643425458885a568177a
SHA512 4edac3362d7ded82934bc7787375ec9695012b0f0d8b82f27caeb110c3a1ca32fc95efc54c90e3d09f5295f1f33c7dbb477908e9322e5c7b865e2a25e3272b86
SSDEEP 384:W5YMOA1RLg6AkSlDrfrGNXhzcFUdjQYb+:WDR0jkKAcj2+
TLSH
T19DA2088BA58CA914CD5C17B01D9BE9AE03325E486FB5D56E3EBE3A0B77B33D06432411
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/7.ico

SHA256 c90c431099960a4954a3e594ebd8b389e6a953af7ea43840b3e752c31090ea93
MD5 6cbb080e313009ebcdffd47221db45ae
SHA1 1861e7fa1b176a32914ed7968b5583419c3c94a2
SHA512 d493195f2b64d5b692debb698bd8e30c964ce40cc93e19ab32b830fee85b2b536843c8f6f432ea85fac79917ca4adc899f75717ad658328751f08e2f0db2a4e4
SSDEEP 192:V3ebAuiOK90OGv4FlYqjjBWL4MdwLUmC5fVRwjx+scYy4:V3+AuiO8BVFmqjU4YKUvMxX84
TLSH
T1FC72E7D27984F626CA5404F019C7BAF31371AE9D763257A1243EB7A561337D3A237603
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/8.ico

SHA256 42907d66610dca426b3b5a74752b0458a5aa5a09c3857bd1fa39469079a5c52e
MD5 678695e082a9659c7730841cea281385
SHA1 4c1d7fba6ce2241d4f45679b9fcacf7e5f7375c5
SHA512 0ab7aa748ca4cbc01d7efcc1249e547a790850846649b4c3fb22a3e94b1d731daa965868a99151f43326cc33e5884843da04e2aa3916b0822993f2416284c0c6
SSDEEP 384:Z3xa16UnJC08VT5F4SLChtx/Ur14M8N9Fs9:Zha16U/WChtxMryMcW
TLSH
T1EB6208DAD8482522CE1C2BB269EF987E23255F083BF6E96D2A2F371677737C15532400
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/9.ico

SHA256 9676fa208500898f8c59bb18117961feb3e25c9023ee5fc59da13282b5469c27
MD5 76f1176c0862a178619f5e6bee54697e
SHA1 d6d6d6e61fe8e024b81fa31b30c77f1e9c4e0561
SHA512 5e45951fdfb217d27e1284c5b6b6e16931724fc4f8e2d58d8463e8b063fe607ae62edec0b230f6241ef29061440c457ca113964df9aeec2140333114314872a9
SSDEEP 96:afSZTPf1gFpoNklOounUEDZ5JvDeFDIla8XwnwYmygkgaW0cIxkuuY9:tT02OsnUEDZrDeFDIlCnwYmyKMxz9
TLSH
T1C112F7818588F61ACE580BB0595BACFD33315E087BB0D3AE2A1E355B7B733D296B3511
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/MANIFEST/1

SHA256 b752d1366a570f28abdd26369470d88e85882668fcd7c586cabe8a219032831c
MD5 5a7d33b3060f5263b3efc42c0302b562
SHA1 445b7cc29aa24cfd44d7d1bfc15f45233945abaa
SHA512 d3f3506aa5930cf51a4583449ed1853b66d1347ca86219b636dc1c38d6a0ca22d600340c5412192e133fbe8ee98edf8336fa7c07ca10458fe51b7794b26714b1
TLSH
T17F319C82C4D0E195A73200D73A65F644EE19476F4D8D82A8B08DD7ABAF32DD5C6931A1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/2052/VERSION/1

SHA256 da0b87340c4abdda7132d63c90def8aba24f300d7323cb5ead9a7ce180a390e4
MD5 dbbc5e64591edd5c2d1584d810b865b8
SHA1 6df3c9c36bfe8d84dd684942ca880b25a71b3c7e
SHA512 637c5923d552117a56d4c423ce4f319a9be5ba2c96e518b16d2814dc05b951049c2de6678941f2f991feaee6f3703951c144f166791cfc7b9a14511871f46aea
TLSH
T144F0224412FD020AF1F70B78F9BB0367EA357DB2DD75D7AC09A1024C28248109AA1BB3
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX0

SHA256 42fb98371f36a51535f3a8cfcb142202b1127c1af1f5a363eb52b52624b54107
MD5 b46b6c138362a437a35012a126d12dd0
SHA1 ee1e1c1405f5a5eec0d5432f2b06eaa5248d09da
SHA512 f57d70f9f2c898d869fe1a0c443e8f31645676fbfd14f7ee089ad78aef5449b15fe0a48eb62f9cfe59e900980f12d6486adea21a360caca1f50f985d94d08cdf
SSDEEP 768:2oi1zxWTtTdQXCxivo+YRGz4pbIrLVKs6ZIvs0D33u:G1zWrQX1vojC5mZIvs0DHu
TLSH
T1DF958D10B7A0D477E6B357321E39BB7A9FFA51225DE49E4743102E6C3863A81C60E751
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 b028a472701190ccdd45ca867bc47fb85f8b18646aa6a9437fb817ce1267eb05
MD5 8f4d93080dfbe8975967bbf14546a42f
SHA1 81f221f1c22ebf2b7677f01b753a5c7f76855fc2
SHA512 a8d0f2f5f3e7824b528ed7dfe951279d00e9c32eea3ccc0f0a9797c71a6c79efe6a0917c05b3daaffe49c419882ba8d03734861293f3eb7def4cf0f81281cef6
SSDEEP 96:G7oD+0+Km65gRieXf9wnLU/0ruugCCxFNls2R3g/KLsWRe8o7SDAOQuF:Gu+KhIi0fUQ/0rfzBHrOo7w
TLSH
T199B2C7933AE8E757C0632A7932E3F34781B1B551013C9606BECCE28FED861859A6D785
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Sharing

General

Malware Config

Signatures

File Explorer