6a08a1f78848f280892cd93e9bc493342ca1eba8bf11a827e21320348714ed39

resource	yara_rule
sample	upx

resource
6a08a1f78848f280892cd93e9bc493342ca1eba8bf11a827e21320348714ed39

IMPHASH dbf0b332bcfb27e2e2bf196f75717242
SHA256 6a08a1f78848f280892cd93e9bc493342ca1eba8bf11a827e21320348714ed39
MD5 a2d7ef5f33be344e95dfdf53ba8c2c62
SHA1 6cda3a7ad9b4d0ea0756d357ee41349615387f06
SHA512 8474b9e69371fa50347ee4441accecd4b4f9e37d6fec9245ea11ffcf42a1a736dbf46178010d874adda8011bf93ccc16197ae6202ccbe7539662ef1870eb065a
SSDEEP 6144:11vohRj78SKhuejPv/vbPbL8vClDNGwR5zpaRvgFi+EMR+mx9fy9IQ/Yx6t7Ev6+:11XJueLHbjL8KjGwxaRvgFXelVpA0U
TLSH
T150B5CFD6A584E522CE6516B009E7BDBB0331AE086EF1C7AD3A6D725E77337C29037102
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW RegEnumKeyW

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create ord17

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SetBkMode

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LocalFree CloseHandle LoadLibraryA ExitProcess GetProcAddress VirtualProtect

kernelbase

WideCharToMultiByte GetTickCount Sleep ExpandEnvironmentStringsW MultiByteToWideChar

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW SHGetFileInfoW

user32

GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics GetDC

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree OleInitialize

.idata

SHA256 aec087260a212d8b3bd4e6985eee331c1023b18b8e227e28bb7c8ddbfaa0d8e7
MD5 27cad23b45df5daf4d40581850b588f4
SHA1 8e16f604bc58ae90a605af1ff2c068c6310464e1
SHA512 702903a9715128a77a00ab61f5a319849d6596255d20636d97dc8070a9a2e3aecf6d56440cdae712c4ae72ace935efe550d6f7be60c83150ef89c78acda6b85f
SSDEEP 96:/iAStGUjvoCrkMv+/7divG5q2gG0fGloQgIrMvGxiCCUrkWE5fdGAuAI:aPGUjACDvSdQG5q2t0JAg2iCCSOfdG+I
TLSH
T132B121FE254C5ACAEFD22F3D1462A7178F94B561043AC874468463DF1F6A3D602AC7E2
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/GROUP_ICON/103

SHA256 d30c435dad4ae0d975a7544e3bd97f02d3353f8bb6e6f7a15ec301803730f22b
MD5 d1f46afc2ccbc02f847a0a736d48810f
SHA1 7d0fbffd5da52a29095ae6a4d72b9d3855221bfd
SHA512 e22163f80a651fa1aadbb4584c3c10b07122297c5db4180dc8dd04cebac32dd3c7547d45ed364f5669b0a982d5a3f2834f1f3e8a641785cf526fc81298dc1ed1
TLSH
T195D08C529B501E8CF2C002BC801B2B07923DC5DBA311534A872FEC00AD43078B82C74B
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/1

SHA256 b3013c3c9ff2d11c103db8f24cc82c85c778272d3cd61b6f886d0009d214f1c3
MD5 40c174ffe776765eeaa58ae71bba00d4
SHA1 235bec37ee2957960f38b38635d5433e9f70cb73
SHA512 fe405aff66957a31ce3357766000e71a92b7a868bee466d14d4c5f9c0dd121d7da16026b252d852669554b537a73396995d04e1b658fc6ee73fca8ecc10ad1ab
SSDEEP 3072:e7pqSKeAuejPv/0+brLOyBLGXvfSfdOjBsDNGgPRD12lCpWxRj:e78SKhuejPv/vbPbL8vClDNGwR5zpaRj
TLSH
T183E323FDB5A74923603358285416A4C0E9E9B342DCF4D9BD5840B03AD75E91F7CF2C96
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/10.ico

SHA256 06b8dacc72490c02db1a3670b0eb7d46602a3bfd62df01a6f5538d37ff136b3e
MD5 b6ec82e3d292b2076690048b36c13ed3
SHA1 65232caa0efca6fb59bc74a591c3b11906238181
SHA512 f202591599abc9226772cc089e68eb34bdb860e0f60bc83ce3f1a59d5241fda855e7b061e8491f367efb43fc639392a95d110efafc9a753ce769f67719de8ab3
SSDEEP 96:kqHBh16RLq7OCtOpaab0Xu6sz6t7+Tph36OnuKJJi:k4uLq7OCtORb0XuJpTph3Pzs
TLSH
T119E1E8839849E551CC590C701CE79EBA57257C098F31CB5E27FF3AA2BD336C695B2406
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/11.ico

SHA256 01c18928fc2fe1b3bffc83e7a405f4f7ffb329e509b04d433ed794388e28783b
MD5 10e063c1ff96f69bd3a9a04c8d164351
SHA1 0206a8907d50b138713cc061bcf7f28c676aa454
SHA512 4e07c756dd9fd7f7b8549cb43781941edf06fd5ee4cec9401569bb0b45f0b048f87afb7b06cde0f4cb2fb9e276f10a576afda05ea47f454da488f9f3e4832eb9
SSDEEP 48:NHrUL9MRN6ku203JGNBgPr2S9FIduuqmpaxQUyCN6tAQert1w8Rw8kMmn3Niiq8:NAMok50SITsdHpuNjrtY1
TLSH
T1FD9119829105B81BD98446F2D6C76BE91236DD05ED35FF954A3F3AA10B333C26673006
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/12.ico

SHA256 3c5dd52cfdb3b3ba501cbf5fdb364dcad7c02815e1200ef6b2a7dd220018a75d
MD5 14086da63bf4e8588d30efbcce117464
SHA1 7afb3b26424261e9a75eefa11f9d666cbb204142
SHA512 f8b8db53ed6fd4075ed08ab142260ca82642a39b26c8ab337b1dd5aa2511f3ecbf3a0c4a2efbe29debbeb2d02765e3df1e8b8a677b0514ea5b60425d393a86cd
TLSH
T1E751C42389027A20C849563986C50AA51164AE8D3036EFFD4EBEB8A02E733D5AB37061
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/13.ico

SHA256 1bc1d513846ade2c334030c7befcc6cdcb759955e475af38e551bf1cf543a3b7
MD5 ddc8d1c0b5957ba3905acec798ffe5cf
SHA1 9b2b6cd72aa13603f87d4fd8745b2fb3b6ab125c
SHA512 0f738d76b4719363a8afbcad76cd4ed0f048db6d30ef54060a31cdd40176c0c64e95f3612984fcb7e1c41ccddcee0ce61b37ccb707fa99f50ab41911dce6efca
TLSH
T1003192D3A5042136EC68B63720925B4A0A3FEE1D219DDD93628970605B3B76FE13E522
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/14.ico

SHA256 75a075402fe02a933a2f2a008e855c80b0a72ddbdd162a56fc6709e340217331
MD5 08b0e5f8c4aea9d5c48f10dfc612af57
SHA1 27e99b8f89327f886f863ab4f9928d894d7654a5
SHA512 99f0c2570923fc9a581164287b6c948f7735529eb705c0f504281f9c2398bfc3411221c7243c0cfc2a5bca6dc2cfb8835a5a969705c6fd9f79570de2a4f3c3d6
TLSH
T19621634AE195F91CF51C06B0E9531928A120EA1B3007832B3A50B6DD0CC368B28FA916
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/2.ico

SHA256 06ee2e350b7c7f3420d34fed6ec4bddd68956153e79fb29c455b28c996b0ab44
MD5 3276004d87ddf405957354401a7303d4
SHA1 9392391187debbfb5ecd9e4eb09859cf3d320c6d
SHA512 6beea8c996ec67e933a111b9978f5cf88eb36cc98ffead95d4742d3ec6ab05fcdc2f1d8ccc696413938666a51d613174f976432ab19f3910f705db81084b03bc
SSDEEP 768:BP9qvf8bsIyrgwznAeMIazsM58aeEWgnlqxj:19qvf8bsIyrgwznuvzsM5AEW5
TLSH
T19E63B4E6A984E126CF2914B05DD7BDF30371AF4C69A393A1697DB7AA2037BC1D133112
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/3

SHA256 2f69bb26a3090db171090a09ddd671c905ddd344206a296ec62fa8dc62874022
MD5 f3b8607e91c11bca5b832a4ed016461f
SHA1 9ba72b1bac1ca9a0d511bef387ceed1a7d59cfbb
SHA512 00c14e7344c956b920d5e3ee078e983e930ed7c40d345a69f3f465ff7d6007f05d0a1baee45679b838ad219194c034444baad5411b147e9e83978d62a787e774
SSDEEP 768:UXGQkV8Nx0ny5ByYhqvQ/OSQr5mmfcGzAOqPLx3zJtceGutCoaj:YGQ+8NxkyfyY4AOSQr5mmfcJx3zJcu2j
TLSH
T1BA13F1FF1099ABF64C061AA41CCF1E3BED5C913C7B7C2A642BB5607CA45A1E8449C9D2
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/4.ico

SHA256 8e18f0ee5c998adde7244392d28caa479e8ce7ce0f6c261c33b4d5e18ca0b547
MD5 11ab97daa85eaa7da90e388e396c6d24
SHA1 16eb860e50d75e1e2e41a1ae9cb107fe43e7f7d8
SHA512 ac5e7cddf7617e33f82c514e1a656e697d9fd32ff6d7d4329fd6c0651be0bba08c217b47bc8ada804d25348c576b37ac234b057f728b7b9ac429b706d7df6bd7
SSDEEP 384:8IPe4sUoCdFhMkDxMibIW01XWGXXmagx5YdgDKQvhpiyKkb7rZeIhHhmH:89xCdzMykz4ooNvDiI1Nu
TLSH
T19903E8C7E5889551CE691BB059AAAD9E03215F483FF2D2AD3E3F760A33733D2A172411
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/5.ico

SHA256 460de763b2836a5388b47d6c6a94603dcffdfc1770a8e906de404424b830b5cb
MD5 4682bcc84ebc1d6b8c267bf4e0d9c174
SHA1 089c72dd26e6a58a9126ce0b3d529e5fbc93854c
SHA512 fdb8e8bd257cd4957f415eba7c8e36bfbf10cb6611bb9dfa7d18f5e702aaacbd719b3f189a21a256cef1c09b5904197ab6e5b6bd44208d211fef06254a517073
SSDEEP 192:gYmGDuQkQXPzp8M9vdLQ/OFudeoqZzwma9IXl8MCe12OTn07JQm:gYmGDlkQXPzpZLLrsk0K07JR
TLSH
T13DC2C7E6A188B905CD9935F0D56BBDAA07319FCC1AB2D1FD3D4EB61636337D2A072101
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/6.ico

SHA256 219f87290906a59bc56b46daaa117dbb2d62f1d7688fc6130fbdd40126ef05d4
MD5 c83d10539ac50fddbc8be3312220990d
SHA1 0d034e49dae50d0f77c6b1224c885b914da95af9
SHA512 b0f1ecbfd3904bd0ad51064851a2e8287c4c702a536ee1ee5c491443d6aa746b9d32137ba5d3fd00e0f798c0d169ebcf7c69e63fdc46897127ab7fdefa8a72c8
SSDEEP 192:L9iMOAgMRLgjBk1Gk0ZliTDIOBilDrm4M8Du9N8OhVxcFU9bPjQ4JPHeygQ:LYMOA1RLg6AkSlDrfrGNXhzcFUdjQYbn
TLSH
T1B6A2F88BA58C9514CC5D1BB01D9AE96E03321E486FB5D5AE3EBE360B77B33D16432411
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/7.ico

SHA256 c90c431099960a4954a3e594ebd8b389e6a953af7ea43840b3e752c31090ea93
MD5 6cbb080e313009ebcdffd47221db45ae
SHA1 1861e7fa1b176a32914ed7968b5583419c3c94a2
SHA512 d493195f2b64d5b692debb698bd8e30c964ce40cc93e19ab32b830fee85b2b536843c8f6f432ea85fac79917ca4adc899f75717ad658328751f08e2f0db2a4e4
SSDEEP 192:V3ebAuiOK90OGv4FlYqjjBWL4MdwLUmC5fVRwjx+scYy4:V3+AuiO8BVFmqjU4YKUvMxX84
TLSH
T1FC72E7D27984F626CA5404F019C7BAF31371AE9D763257A1243EB7A561337D3A237603
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/8.ico

SHA256 dcf93ceef62e57382e747a60ac901d680a586fac1e5ce7f3d26f61cbca9bd64d
MD5 7447928d596527c7992a1d4fd5968506
SHA1 1a2a7219294998be35aa17b462c489229f4d35cd
SHA512 28b279a32d8326b2a11d2078ea290022b445d207a778874cec7f8db4ff72aa0b0f70123f37645fae7332a5a8f9bf26d76c5f20d99585de3efd1c0cdb6afb4b07
SSDEEP 384:Z3xa16UnJC08VT5F4SLChtx/Ur14M8N9N9:Zha16U/WChtxMryM2
TLSH
T13562F7DAD8482522CD1C2BB269EB986E23255F483BF6E96D2A2F371677737C15132400
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/9.ico

SHA256 9676fa208500898f8c59bb18117961feb3e25c9023ee5fc59da13282b5469c27
MD5 76f1176c0862a178619f5e6bee54697e
SHA1 d6d6d6e61fe8e024b81fa31b30c77f1e9c4e0561
SHA512 5e45951fdfb217d27e1284c5b6b6e16931724fc4f8e2d58d8463e8b063fe607ae62edec0b230f6241ef29061440c457ca113964df9aeec2140333114314872a9
SSDEEP 96:afSZTPf1gFpoNklOounUEDZ5JvDeFDIla8XwnwYmygkgaW0cIxkuuY9:tT02OsnUEDZrDeFDIlCnwYmyKMxz9
TLSH
T1C112F7818588F61ACE580BB0595BACFD33315E087BB0D3AE2A1E355B7B733D296B3511
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/MANIFEST/1

SHA256 b752d1366a570f28abdd26369470d88e85882668fcd7c586cabe8a219032831c
MD5 5a7d33b3060f5263b3efc42c0302b562
SHA1 445b7cc29aa24cfd44d7d1bfc15f45233945abaa
SHA512 d3f3506aa5930cf51a4583449ed1853b66d1347ca86219b636dc1c38d6a0ca22d600340c5412192e133fbe8ee98edf8336fa7c07ca10458fe51b7794b26714b1
TLSH
T17F319C82C4D0E195A73200D73A65F644EE19476F4D8D82A8B08DD7ABAF32DD5C6931A1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/2052/VERSION/1

SHA256 09712f8a04cacf424723882fff55f7ca32030a97bcfd29f6be84c7e946162f30
MD5 baa1d864a9436c7d710c5918394e6d55
SHA1 7719de07bac2727116316d2aad4963b1e68e9672
SHA512 d9e05842efbc8457c5f6d836c72dd2b0e32566bf1f0994bd5fc418b0fb1c2bcf3efe3341e34c3f292209d6de9bba55296746f7a260a69d3fb58550dd52dd24b2
TLSH
T1A8F0C24412FD020AF5FB0B78F9BB0367DA357DB2DD75D7AC49A5024C28248109AA1BB3
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX0

SHA256 2a480d36b33e07039d4314353bcc4652b9c6d8dc17243566555432b29d739003
MD5 a2b62624d72b2271ccc08462a9ab9a7d
SHA1 07ab9aabbbd30b8849559c594815da2f100aee7a
SHA512 8a8516ab576970d96136549d78657beb6d4457f08354ecc2acc1b8b9141ee0c3167a8adae5d6711408d9267868a7db05808c9b8ce1efb6bd3cfa5efd7021f63d
SSDEEP 768:2oi1zxWTtTdQXCxivo+YRGz4pbIrLVKs6ZIvs0D3Tu:G1zWrQX1vojC5mZIvs0DDu
TLSH
T11F957C10B760D477E6B357320E39BB7A9FFA51226EE49E4743102FAC3863A81C61E751
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 b028a472701190ccdd45ca867bc47fb85f8b18646aa6a9437fb817ce1267eb05
MD5 8f4d93080dfbe8975967bbf14546a42f
SHA1 81f221f1c22ebf2b7677f01b753a5c7f76855fc2
SHA512 a8d0f2f5f3e7824b528ed7dfe951279d00e9c32eea3ccc0f0a9797c71a6c79efe6a0917c05b3daaffe49c419882ba8d03734861293f3eb7def4cf0f81281cef6
SSDEEP 96:G7oD+0+Km65gRieXf9wnLU/0ruugCCxFNls2R3g/KLsWRe8o7SDAOQuF:Gu+KhIi0fUQ/0rfzBHrOo7w
TLSH
T199B2C7933AE8E757C0632A7932E3F34781B1B551013C9606BECCE28FED861859A6D785
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Sharing

General

Malware Config

Signatures

File Explorer