86dbc26fca670e83a6983bb8a344c7effa262d4ace19c868a5f4613cd0566bda

resource	yara_rule
sample	upx

resource
86dbc26fca670e83a6983bb8a344c7effa262d4ace19c868a5f4613cd0566bda

IMPHASH 8e33f648bfb04328ed39a98344102338
SHA256 86dbc26fca670e83a6983bb8a344c7effa262d4ace19c868a5f4613cd0566bda
MD5 ad2ca74aaeb47b1f99939bf1bf55f245
SHA1 cd6658ef1617a56cfbd162181a6dd4515e6e192a
SHA512 49ad5c5675ab9eff50a3459d95b75c3f1ccd242726453d628e922b8c217027c9cbcae106d70438697c654e9ff3ff4bfa05e66d8b63c82715dc488e36ed1e66bd
SSDEEP 6144:k1vo+Rjc5zVcoGEWX3IdbsrLxGNHJ44euFh0bTL7IHn3k3:k1M5SX3t1Gj7hgTHAk
TLSH
T1F7A5BF82FA45A051CC2A17719C96C1771B61BE1D3EB1C79F3A2D326B3B336C3626B251
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW RegEnumKeyW

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create ord17

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SetBkMode

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LoadLibraryA ExitProcess GetProcAddress VirtualProtect

kernelbase

WideCharToMultiByte GetTickCount Sleep ExpandEnvironmentStringsW MultiByteToWideChar

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW SHGetFileInfoW

user32

GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics GetDC

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree OleInitialize

.idata

SHA256 ea6359d688a4e44d67bfb7586aabcd9653ef6a219c13df38f26301c3ac673ed1
MD5 1cac873f4aba869da2d17dc275ef1a94
SHA1 adba9068c449d6e87fefe02e43dcfc9dc17ed5b5
SHA512 4c6b2d811ca23bb05797874121986c5a65b861e67bf5bfa6136d7c0d5c327026b5d9a1b25d73f9fd82266cd797777dd08ebc891b68fe8dcdf26159e871dcac10
SSDEEP 96:CGxl/XLrpwf81/jXXnHQlEOQv+/7divG5q2gG0fGloQgIrMvGxiCCUrkWE5fdGAt:Cal/Xl7XXnHQAvSdQG5q2t0JAg2iCCSY
TLSH
T180B12EE979BC0EC6E2A16E3DB45163678DA0BB250029483C46CC528F5D4A3DF166CFE3
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/GROUP_ICON/103

SHA256 58cbffc23f0d5a14da2d280515fc4ef361cc5c34e9b5030c303b931a9e4be2fe
MD5 9d7874c3c7cd12126cf7a6fabb9489f4
SHA1 695b3d8f3c40c507caa0024668d44f35e68a1dec
SHA512 1f83cf81927a6472873a192e99de47c8faac0fe2c2e0aebfd34d53151b4a79942a2d61469df3b44e0bb0979de365077c857e436fc46e6590e38119d10d28f0cb
TLSH
T102C09B529760194DE3C401BC9455571B55BDC4D6F1164A44861A54518D431D46D5C746
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/1

SHA256 037db44e4cee7315ccf00ffb3cd2c40f428c7ae3b9cf8ddaaabbacde9a4d3024
MD5 7972106666ec793f833c1f4e58b72281
SHA1 05309b02b4e0f2b74ce08aec7476c87339c12e96
SHA512 15a24c0ea798389fddf9303fd307487c222c77e30dc2917b8c3686642db57c2fd8f82500548cb4fe8e3230e48563ae1e1c71a7faed3d637aa857b113836a47f1
SSDEEP 3072:JHt8h/H5gUVhOoGEWXYQIdbIJrnHWcVb8p1/1Rh9:rc5zVcoGEWX3IdbsrLxGNH9
TLSH
T15FC31249FECB52B9CF6E1C13EE1958893F711D6A4770C40B3A566089F6CC80512F96F5
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/10.ico

SHA256 3f32afa4fe1de464de00db117a19a7365a4847d77ae3eec95aa57be7aa5fbcbb
MD5 7ba0c7be99ff2e0bcb33fe5c0f203d41
SHA1 74a1008c767574c014c07b042b4117e20e2dc0df
SHA512 92cc016e74ff78a391be5ae873f6a66751c4877d7abca0025f06a17fa27f4e26f96a40c131e2698d3e2a448fdf1d10d0feada7798fe4dfecaa1763648be3d9c0
SSDEEP 96:xAQUBipzL8h29gb5X62PqxAYi+0NCdNAN:xm09g1qx9i+0NCdNy
TLSH
T18B91A707E22CE1DDCD28823D84874AAE1771FC2EAA7053DA157979B3BA33995D50780E
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/2.ico

SHA256 98d5e0ee8bae85a209d0133eb90266f456a395c54a7d1e2abd6d5d5fe2ca4c8f
MD5 36cd26d0e8242d39552836ac695dd482
SHA1 be06ef89125805a5da69df6678f178622722865a
SHA512 2a3acb7ad7218186aa10b321614c7412df530f898c209f6822113184ae112d696b5bbffef2de9cfdea2afb19606f164500b869bf54e7790c13cb95cf335405a7
SSDEEP 1536:D7FEFV4PEzAdEh3cju1fjgaLE05/KNhUCCme:M4ky+1Eu/Nh
TLSH
T15363F986FA44E055CC1A2B7158DAC57A1711BD6D3EB2C2DE3A3D321B3B32AD36263161
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/3.ico

SHA256 357c7ab1ccb7413eb5fe2a30b4a03eaa4f74cb3f489c7095f752cef9d9a27c41
MD5 37b1de2487b8761b402b40ba28c34928
SHA1 4f74564dbebfbd387591d866c996083333427644
SHA512 4115ed4dcc319a4ccf7b3598ec7665886cd43da9eb9e434653bab598e97cc07b68ff655dc1f8bcd1f5e82667e8ceca12d83234e82b616745390ecfe1b6a8029a
SSDEEP 384:phn+OdcRc9FK/Ol+/p6UhKtrcdqTfJqIbfOwXz65pqg7Yi:jndcRL/OW4iCRBbfO68F
TLSH
T15403E786DA886450CC5A27B0989AC57A1759AE1C3FB1C2DF3E2D336B3773BD2B572410
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/4.ico

SHA256 3ce8137897aea85551a2cddca3d878320720e2c28378d315e1b80a7cbd835c52
MD5 0f532d336c90207e9ae4fcee6cbf3c7d
SHA1 991ee87b10c13cd12225ab591bc2094ba4ac2f79
SHA512 d7b7923e17f6e5de263b6643e1684b82b52de2a363bd5e9e4ad6eb41356430770349cfb00d5f9d29b9e4e7f38ef9bd76161d15e39caea243324446c09f8fc0cd
SSDEEP 384:zL2e5xkZeOsJJmTNUNMC/rmJiebPrIJ8KiGg42otMzHt5LRPZr/P4:zL29J9qPiO2oy/x2
TLSH
T1EBC2D682BA44F021CC394972ADC7C5F71741FD1C49B3CBAB292D77BB2437A92A167126
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/5.ico

SHA256 a5c370a51e4fbb8c4e8a2df7b1d8c6827fa49ae3f3be48a4b6a5feb2a3080607
MD5 8d669fd6af2d90112088e13c733a0a66
SHA1 967d6053b5f1c93790e1ec906503742e5e79b908
SHA512 6dd1d498a61a03dc34222a66798ce6a6ee0051dfa5ea78ad404d7bbee1e8c8805ac74a2a3bc698db6f44c3dab18578880e3079659c599d37c402d2f414136232
SSDEEP 192:mhAWZbCUxTkZJN1lTnNNBq/JDfVzBEUrP8LbM195il7nOl9OABe:mhvZbCUxT2NNYjzEUwbMH5Wyk
TLSH
T148A2F887EA487411CD8963B18596C03907187E5D3EB0D39F3D6E331BB7B67D36262422
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/6.ico

SHA256 d7d740d9783dde26cf06c326476dabcd2cb080e4eb57bd6fe246240b69520ecd
MD5 76821fac838cbc5c70250f9e8bef3409
SHA1 c28fd29bdab0ce6813a87e4644dcca6eb58a23a8
SHA512 7600b2d9ad23565d72760882feb364e93520733615a4db4b7f462f8c4749db186eb6a406fc3e17b4eb9a402677cd17afc2ec31b227dc73853cfadb5f5281d414
SSDEEP 192:2ox13K18zw7EfCd8N/iB2GUDFe3aA9qd3I+kv4AlyrCyLZwAo2:H13K18zwofh9uSAaQqdMn4r9wh2
TLSH
T19B721986AA89F015CC2A23B168DB81F60342BF1DBEF3DB1E353DB1653733AD16526112
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/7.ico

SHA256 f177edcedf52c467f7345fdf01d77a61d6d375b187d3921df6094f92bb1e5b76
MD5 5c59440af516d976fa208d7f93be175f
SHA1 4dd85774137c173b2d633df1bae0303ae810f35c
SHA512 6886cb99dfa07a1f4e8cc8a3ba10cc9c356875a44fc807c7349e49f9fd07cc2eaed8880f8a2078d2b686ddd49192538b7e240943ac2c5e71f312f0bf7a8be033
SSDEEP 192:CQ4ceSqcUGMnqInMPQGDFjbJe9fl8+EcIk7vBCma99muy:VjeSqcUvnQzDe9fl8ZcIkjQma99vy
TLSH
T1A7620983D9082447CC6A4BB144AAC53A7315AE09BFB2D5DF295FB3663377BD26A63400
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/8.ico

SHA256 43d9c667b2c5cef09fd93356123369d1bf1b0dd722b41dc387c9f3ff7b465b61
MD5 becf734a42544500d384be65b44f2052
SHA1 deb52c77c1a23e68b85f312c53aa31631a67563c
SHA512 a9e699b505ac190e2ca51ed0bbe306260de33cf25ddfa2414b76b87b20b814a6ab167f90900f7fcb8c2362bf5ed05a0267d9d1a64443c03127d3e2fa52193411
SSDEEP 96:wbzwL91GxH3m4nCJxfBANrXi/FyyD9RukZdxW5uPm3fW7ngpFB:c+91XiChwitfqkDxLmf0kFB
TLSH
T17D12E88649C9A517CC0A8B3098AB89361752AC093EB1D7BF190F37AB7B737C3A153135
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/9.ico

SHA256 627c277d994ec0c44573650790ff74a706b6a4efe9499d55f8efad2757ae8961
MD5 902b18875bb61d46cd223d21a9c2ecea
SHA1 480461dd3a5ca3b9649017df8930cbc12e1b755e
SHA512 5bc7ce1a0c148aaba91b4a961992475c02aa15595a89bba2f783a6c01c0f31016461bbb04efa8c9ec3cb2a70d1181b2fe2625b825890910bfa739dd5a2fd52fa
SSDEEP 96:ZxAhS6aKy9cNxQ3E7D5YJcGLd68HcEFooooooooooooooJP:8hS6akN265IcodqWP
TLSH
T146E10A81AF806A55C88D0372299AC9FE1BB16C2498B0C9FF2475733727732C7589702E
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/MANIFEST/1

SHA256 b752d1366a570f28abdd26369470d88e85882668fcd7c586cabe8a219032831c
MD5 5a7d33b3060f5263b3efc42c0302b562
SHA1 445b7cc29aa24cfd44d7d1bfc15f45233945abaa
SHA512 d3f3506aa5930cf51a4583449ed1853b66d1347ca86219b636dc1c38d6a0ca22d600340c5412192e133fbe8ee98edf8336fa7c07ca10458fe51b7794b26714b1
TLSH
T17F319C82C4D0E195A73200D73A65F644EE19476F4D8D82A8B08DD7ABAF32DD5C6931A1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/2052/version.txt

SHA256 52ebec109ff57f1c3be64d3a0ac23ad732befdaaf18e691eb9a36e2745b880b2
MD5 d0443f281ffd9574ea36d8f449857b76
SHA1 7ede34419e5c6407e5af4f7969b72d14152253aa
SHA512 14b9cb13844201a12795f19e9bc73888d1c31ef3371b460cd44d23b56d478c4300cd00f96a697ca450d26bf52d7a64db93530232d6e355607ba56361c150c61f
TLSH
T17421F30A51FB3298A0A7658D8EEB8C3247A33910487DD25E94CD3E8D0FD34040A21BF3
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX0

SHA256 0d8f665ae1eaee055e41f8dd6d582022d1e7f4d1116ccd42007329da92a24004
MD5 c0ed9e16b4b09c4ec3f33ad11e1f8a9f
SHA1 e3e2bf38567a2500263e5c84e22ddf5112e9a2ed
SHA512 50c437a05e3dd21e8e05933b29ca179c544d70a8f7346f916d3b7c68333685c97e84ef098c0bc53cb26ad6ae4a4432582a6c3e19f66f2a6ad83be8ff5eb0484f
SSDEEP 768:2oi1zxWTtTdQXCxivo+YRGz4pbIrLVKs6ZIvs0D3Au:G1zWrQX1vojC5mZIvs0DQu
TLSH
T14A858D00B770D437D6B353321E39B77A9FFA56226EE46E4783102E5C3863A91C60EB52
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 b551849d3e29ea1cb7fdab218f9d2b882bd26f358a0243abb003124c3f6a8bdd
MD5 19eaa33a0a6649a279d68d073fdf616f
SHA1 65abaad683905cb00fd6b47e460f5ce6ed0c0b92
SHA512 38c014475d0806aefe46e19dcc0a693857c1125c6a2641957990eca800bf316e3d0a2ffd707cfb672e728cf88c658f407089da9bb829e0fb889e6b5fb8e09fdf
SSDEEP 96:m7oD+0+Km65gRieXf9wnLU/0ruugCCv0fZ33NBv+1QCTbjeZ1s7v:mO+KhIi0fUQ/0rfzQ6Z39cxH
TLSH
T172B2E8837EDCE31BC0636B7832B5A35341B0B151147CC546BEC8A69FFE8548A597D386
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Sharing

General

Malware Config

Signatures

File Explorer