b45b4d770a31d9f68554876d60f4091c2031a31405cdf05d758c6e73c0d61e14

resource	yara_rule
sample	upx

resource
b45b4d770a31d9f68554876d60f4091c2031a31405cdf05d758c6e73c0d61e14

IMPHASH f453a169c813be2a8e0b0cd728d12360
SHA256 b45b4d770a31d9f68554876d60f4091c2031a31405cdf05d758c6e73c0d61e14
MD5 a9af100e91148d4574c00845a45ce2c4
SHA1 a08084cabcb3ef07c723ac08877a9263dd8c7ce2
SHA512 2573f6f3b04ba82f04293a3db21ab5e0c75b9b653025cd23dae6ca842a95edb193e0cf522b98f35333140bf419f27590ba608f748b086bbeaffe494e20d220a1
SSDEEP 12288:Q1eEHCYa3ioTVjZv3A5oAiuIQ1txJwfJd5uox8RU+aoeTpb0:Q1eEHCYaSoTNmFvtvwluv2TR0
TLSH
T155D5E149E7489395CCBA0F706CDA902607273D1C2EF5D69EE26C312F37BBEC16A5A111
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW RegEnumKeyW

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create ord17

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SetBkMode

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LocalFree LoadLibraryA ExitProcess GetProcAddress VirtualProtect

kernelbase

WideCharToMultiByte GetTickCount Sleep ExpandEnvironmentStringsW MultiByteToWideChar

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW SHGetFileInfoW

user32

GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics GetDC

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree OleInitialize

.idata

SHA256 3f4b09717c7350c04781718a21b7a223e5378cf12eace37cae9424f0427f7c64
MD5 0842e06a823611fc2327e59583e761d5
SHA1 1ef0250f96dc1641344c342e3f5bcb496798fc0f
SHA512 2b38622e978a192d5db51218ceaed43670cff33ad671e5d90a637d37ea7a1438971362e26069dfb26fac2a8e64e6da27b5a749c941c569979fb18ae81ad64c0f
SSDEEP 96:KZ822crorwXvv+/7divG5q2gG0fGloQgIrMvGxiCCUrkWE5fdGAAAI:p2hgIvvSdQG5q2t0JAg2iCCSOfdGsI
TLSH
T12AC122E1EA5C0ECAF1632E3C18AE61078DD1BC22089ADC6C16C5528F7D497F61E2C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/GROUP_ICON/103

SHA256 99551fb9bff5a709153ccd2282e7f79941d53d2445bbd56bc593f3273081993a
MD5 c76e5b47aef8a29d1e6c0e15b3683119
SHA1 bf44baa7260e61f7f8c1d2cecd043f3a129fa291
SHA512 89d5145b42ed3ed6b4596325c9e7e7542f42ab63a5d3930bcd3149784cee2c32989676dc0d242bf53424bc73ee7e4a2731b43375d53b564b30594ff6b83706de
TLSH
T1E4D08C014B101E4CF3D002BC802B130B933EC9DB4320830A8B1FE8006D4B0A8BD2C74B
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/1

SHA256 008df499fe74fc5ab6804505027f3185b62fe168973f28608a41f42260ad2a66
MD5 901c68487f2b57d79dd345a786897e79
SHA1 fcf59b2d80bc25e2825ba0154dcc5a374ed047d2
SHA512 cd60ca8c50653640e5dd1ffdd2ad44efebc20a98bddc0f5b58f9f7c3901bab6d2d0f1dc876d3f8ad7cea8538338e75ebc550fed16afdd9489c84887aa03957c0
SSDEEP 6144:cEZxCnYlcrvDaD5GTv9ca9Zv3AwPU80WyLGXX+IG5dJDPRic:cEHCYa3ioTVjZv3A5oAiuIQ1Z
TLSH
T17F6423869D8D4FEEFCDF0DC8FC1B810E89992A69DD5A0192E70CDCA014A5E9D6F05713
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/10.ico

SHA256 24a8773db765c0cd58b24612b4d7ae1cdff235988a688fa1bcd50ad48ef9d8fe
MD5 196b4a54e9112ecf18549da8d310d233
SHA1 53362e1d47c0c1bb283ef49772718cbca08c5f15
SHA512 09a046db6657c351a05be495b75bcc3fefe7eee0067f287ba3109d8e9b180e8755b4342859630ce9d1cd78711cac07991249cacb008020520a6b1720a820376a
SSDEEP 96:IvrXS66rvjLIc2g6UuLnsZ7TWxKy5URvq7HyyZa:IDC66rvXIHg63LsZ7xqUaS
TLSH
T12FE19456E304E30DCCAE0D32A5EAA1BA1B433D18CDE3A76BD165715E34BFD91652E013
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/11.ico

SHA256 070a134dd836f353582c08b08fec7fc46caa08abd34416a5da74f39452a05c4a
MD5 21bccbfc1e2798332534cea570c2e6dd
SHA1 6410ba360c78d49317ef9ba0b678470e8f5abc13
SHA512 2fffa2a617a3428881002026a4dedba17da54b2ed85dabfa5d6fa06874bb21f966efa0b3c5c8c6dc78372eb48c252fe3f7a2a81d6d2f994c054265fa4456af13
SSDEEP 96:fGwhMl7+C+SicZ0Hi63zmsAvQF1rSwHwUQi:f2xmSlmCiAvg5SwHwUN
TLSH
T11191094EF10803F8DA68063224DA806A2B3A7C0E2FB55B5ED16A31F63F73384544D445
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/12.ico

SHA256 dd8624eaf85fdc91cfd7ad0197e4053558810a22908a57c7e6f182b7c3e3674d
MD5 ba9f90589b7d6f2de060539876fdc384
SHA1 6435cbeb5dbad49239b556cedca708038871fc0a
SHA512 17f19c05e036956a10c671ecc9d5aba8a3689663610d9f96ba1c9038aa54c61d8b0861d9d1d648446402a2118b2a765c7666a2dc6184003cbbe67bb0b8e9f929
TLSH
T17751E788F744C734C95C08B125C2A88AE70BBE0CACF25172D2C4383D3AFB88E075A401
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/13.ico

SHA256 ccce7b3fb8e14b54508038582bee3eaa20a103e99127771c8ce4a226af005119
MD5 5a864dc92e43057cd9d200268be37d05
SHA1 dcecb57cae115acc622a47c63d3a03bbaa321ab3
SHA512 18ec8ca4afb324cdd80f38df9cd8b4b8139a8203ec84737027243c4da5723a54ddf4285cd12c7cf7a49f4ab65744198a87cfc1bce215203481e1585bd97a6eb0
TLSH
T144318768FB90D2B7ED71DB3610C615E7C71A5D0B06A2DE95D243F43D1A63412101B8D4
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/14.ico

SHA256 03213481ff4f650165f2119067e5706c4aea06761ab85ebe481f0edb9e4f62e6
MD5 3a565bd087e3b6099e442fb317f52e5a
SHA1 770963da1f37e7874ec7508e7eec15c34a09ffc9
SHA512 9c2f1c77d0b7f828ce114380c7414866239836e638f2c90417484ba3adcfc00203794271566ab3e1a987c3c05b399f76c83b431880487d2fa80d5c72f030fa4e
TLSH
T1E0215658B0C9AB99E28600B160430745472EF328F293872BC10386BF8F935C5AFEB648
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/2

SHA256 23f3ef963c53d2905efeb50ad03400a958e9852ce67326969102a878764c318e
MD5 8dff198cc9b0c27724a528f5bfc15c52
SHA1 07c3a12d5b765d0c3ada1fb8cef64ecec5c07acc
SHA512 3fd93a9481da76bc2c4d74b0d8d28a04d0ae24c3642512a6a437def5c29fa8d44982e64ed64412a66f87aae9260c2ca25fa4c4d0b29e6ddadf0a2252e5ee10cd
SSDEEP 3072:Xdti2SJFBkzVtHfmpdl86bd7QPgKeeK3XWoX5QnGju:/Nuoxdfmp46bdUhId5uou
TLSH
T117E312F7FB5482A8C01228AC07EA14575C35302E59FEF423E7F2748BD86DE2584ABD61
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/3.ico

SHA256 7583e68142e66de142ab2d697335e654fc514acfc689be4ccdb23bd815381800
MD5 79f63917fbd56b8319c4e3c7a27406d7
SHA1 c9683c281fdb5a730d38b8290953624dfd800b60
SHA512 ae235785031d4351042e1d0dd7aba0d45d46fbeeb3153c1f0783497192c0976dd6794bbb789828fae337a4b910950db661555ce30954e36e755f2ae6cb226712
SSDEEP 1536:vDVg57WqzENynEo+xE+zE5oSw0DUNpDJwEAAj:vjwRYntN
TLSH
T18563C799E6085395C8AA1B706DDD902A03177D4C3FF5D69EB57D322F33FAAC26362005
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/4.ico

SHA256 727bbf631eb67a914304e78d694dd940a509d31ecb433f973eb36d63f01cb0d2
MD5 4783323ed690f015b35832abdeb30491
SHA1 47cc60d473fb0b1326c8c759c2551af84f6d4ebf
SHA512 27a2eaa7506e5daf950cf393da598a1e614a356d0d5d032b9929ebe577380d444c6f070649a42fbbf3bee1b3aafd5144bf353d18e19a23fe8e2bbb6472c9d112
SSDEEP 384:yBdrf9VFsP3s1E1BMx68iRJwUhskvh659iy7e5kb92o8MzOZMmKxkAMWPw:edrfzyfs1E1BMURJxXs7exo8o7xkWw
TLSH
T1AB03B649E6086394CCA91BB16CD9905A03272D4C2FF5CADDA97D321F33F7AD2B366015
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/5.ico

SHA256 db31d05371b4d70cdf429df9e2700fe95a2cefe9a474d610b68fb139ae6c4b88
MD5 88a4433c404ffc097fac1db2baff40b3
SHA1 e1e09f4e2a07e271075e61556ec8a7991f31b7b2
SHA512 35d9e28c31198918d7516f02276a609817622efa4f26d3aff4c1329ab6163cb40b3e177cdeefb58048c01a94de0dfe047ce6ff5b6674c00f837cdf3f509050e8
SSDEEP 384:r6u6bm0UAXvLCkwMmm08te/uJPXD41NA7++cy:r6u6anovdf01G79cy
TLSH
T18DC29558EA049398CCBE0F71B9CAE46603177D1D3EF2D39EE469322F27BB9C11166056
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/6.ico

SHA256 3b5cbc06a92976c2f334f611833edffd9cb45be891e7614f44a4d2d553b77667
MD5 df40c774246de3a34681249aa6569202
SHA1 26a91f799e053239abb7e376b1ee08a000db9647
SHA512 671850c6f61dd2c86aa20bc1c50adfe344aafec88b2531f912230c0df0b7c46a38b061667a99624c7e842647977883de4aa7becbb0fe1254dfb61b76c6250699
SSDEEP 384:MUqyA+z4nfGCh5AFftXGy9BBJ/n0zUOMV:MUqyA+Gf3jUtbLL0M
TLSH
T1CEA2C74DEB086B50CCA90B316DC9D02603232D5C6EF0C29FB1AD362F37FEAD16292556
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/7.ico

SHA256 2f98b264502a22428715ca8892607748e34cd9bc4ba6892b4407755b3a99153a
MD5 f42edb0c2d223579ed883ed59f11fc81
SHA1 62d59737ace8e077dff1c4f54c5495de0723a182
SHA512 fa0ca860c51f6a9c0c933b5988c2b57a220ee68dcdceb0e63e3eaff1ebe9a6a1efb803559038c789e2351055cabb213ceb209f67489401f82ed0890ba7c89a92
SSDEEP 384:2wl08QpN5Uw//TyMMpr+t+x6CvrIOg++pj:24OpNawTt8rId+Wj
TLSH
T14372F749D604E316CCBD47B025CEA12617276E5C2FF2DB4EEA6D312F23FB6C12666019
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/8.ico

SHA256 7556801938ee230a58d70210087db16be491165e5126804c73ea8604d7b76085
MD5 3cb29a3ffa2eb37d37350ab98cdaf53a
SHA1 aa321f7da74f65676814eb1706e967eb51208928
SHA512 e7b8ff522b4ab0c63bfc5c9e245f17c61ed5dc7ef512649acbbe93c039a17d8f6d2195e9f38148092b6ffaa6e107a7a92ff9d2b1c47a1ffb7d043c4d1d3a3104
SSDEEP 192:mShN56G/H+eFmLkpuFi5JYzT3vDms6OBDDj9/XtwzWM:dYG/HFmtFiMp9J6
TLSH
T1E462B459D704A21EC8BE0DB27ADBA0B31303BD2D1DF39A99C1AD736E15FBD5011AE424
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/9.ico

SHA256 2c3199bfa39e2ff0bff912febbdbba28765fbf3a4b9e7cc3406d0edd8f3260f3
MD5 49cd473b834bb5ece5cf682cb5b1426d
SHA1 fd326b001fef236a7ed6a7c5b99793cd21a62ed1
SHA512 eea75990b4ba22bea8e8bd6037344dc9fb459e0d2842f1113d1e54e85e45106523a50a7057e14fc644df3c7d9a7d84685f0e7aabfa22e2187bab8c7240d9b9d3
SSDEEP 96:tWesU9qJcKuXUzy8vfozkahWgFT4bjVu7CYkNxjVeZON+4BpiAYB:cU9iuXb8vfjCLFT4vMG/NxReZ/IiAYB
TLSH
T1D212E748C751A35ADDB90F34ACCA8466031B6E197CF3E78EC559317F2BBB5C1826B026
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/MANIFEST/1

SHA256 b752d1366a570f28abdd26369470d88e85882668fcd7c586cabe8a219032831c
MD5 5a7d33b3060f5263b3efc42c0302b562
SHA1 445b7cc29aa24cfd44d7d1bfc15f45233945abaa
SHA512 d3f3506aa5930cf51a4583449ed1853b66d1347ca86219b636dc1c38d6a0ca22d600340c5412192e133fbe8ee98edf8336fa7c07ca10458fe51b7794b26714b1
TLSH
T17F319C82C4D0E195A73200D73A65F644EE19476F4D8D82A8B08DD7ABAF32DD5C6931A1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/2052/version.txt

SHA256 6b4dcff415996018b3ddfafc6ab6655a9b4380a73766a9e1e709a44681989b7e
MD5 b6a541240d87ddd17fbce5c883422ed4
SHA1 ee763d4e32dacf82ce709a7a06cf71d1322275ca
SHA512 96f9cae88d4fe77e0e7ffae9c17fc6de475969a64601586e45c7c60ecae0569c642d4e45ba826c78b28ecc6e0325f494fd5ddb3b0d70d2fd5d256df4efb49006
TLSH
T10921020A92FB3658A0A7694D9ADA8D3203A33D00087D939ED8CC3E8D0FC74065921BF7
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX0

SHA256 049814659abad7db831069fe4fff8cb1af0aa1fb119bb2fa9e40571664247bf0
MD5 15b7087cedafad2cf8c11d74229d869c
SHA1 c191a23c01bace9a4ef464587482bbfdbd5aa9e6
SHA512 0d23ade9229f63e58a0404bc94c9e9a80fd609ac73e4cb68d700dda8b330415134fdb4b6e3d127033f4c0399f656254bdef8ee1927e21f81832793ea939b2216
SSDEEP 768:2oi1zxWTtTdQXCxivo+YRGz4pbIrLVKs6ZIvs0D3Ou:G1zWrQX1vojC5mZIvs0D+u
TLSH
T1B4A57D00B7B0D437E6B316320E79767A9FFB55226EE49E4B43502E5D3863A81CE0E751
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 7f0b8689809a9fd3ad136525e52a6f101cb7a17be162005d2249d65a8579acd5
MD5 8bff6ad610cece0aa0f91225c06280d5
SHA1 de9df9a63fbb188c418862d0b73250dde4892271
SHA512 96e081c3c5f852726446e0c6b09e57866f38e54353f321e734dee648c26c8d8cb1ec7871e15d8cc1e03b805daf70a921e9770b9aace2315019bb02f6cb239a85
SSDEEP 96:G7oD+0+Km65gRieXf9wnLU/0ruugCC9StVvGEMGHbmer5L4thE/AsMfY6Z3s48:Gu+KhIi0fUQ/0rfzS0hvbtOu/As4sj
TLSH
T128B2E8932BF8D71BC0972B3873F2A35748B1B251012C950A7ECCA75FEE82982597D745
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Sharing

General

Malware Config

Signatures

File Explorer