virussign.com_b4a57d0c6e33223ccfcf0052d015c140.vir
UPX-packed embedded malware
Binary contains a UPX packing markerUnsigned writable-entry high-entropy unpacker
SHA-256590aa42f792d2123549d54c0a0a8345fb0c5405fcf325de174ca774c94f93dfd
MaleculeK(Mc)O₂(As₈Er)H(Os)Md₄(Bi₁₀HeSi)
Evidence
⋯3 more rows
0x2e800000000000000000000000000000000................
0x2f855505830000000000050010000100000UPX0.....P......
0x30800000000000400000000000000000000................
0x31800000000800000e05550583100000000........UPX1....
0x32800900000006001000082000000040000.....`..........
⋯11 more rows
0x3e82c8f8ba8fccf1ccba6b90100977e0000,............~..
0x3f800280100260600aeb93bb2fd0020c430.(..&....;... .0
0x408400005d8eb340b009437bfff73f3a037@....4...7..s..7
0x41801bc3ae80600406e20704a23ff53dcdc..:...@n pJ#.S..
0x428fc3ea45a05385d05b06604b864eff3f9.>.Z.8]..f..d...
0x438dc0ad874f07c0c78d081479f9bbbdfdc...t.|.x..G.....
0x4488805ec8d0b032c9002a8959097fbfd3e......,........>
0x458771d06c49c949e0538a059bca195cff3w.......8.Y.....
0x468b9b91478a41548a6a0a6e0007e7fdf91...x..H.....~...
0x4789c5c4805ac9501a3500b2a5477e4fbf9.\H.....P.*Tw...
0x48895500078676bb4e0950bff7fb1e71096.P.xgk..........
0x4984c5f00eb1066623a432b2b484f4fdd7dL_...fb:C++HOO.}
0x4a877fb4b90e998d017a18b04c1e002a38fw.K.............
0x4b807526a00bedd5ddbf7b39e130637ac5a.Rj...]......7.Z
0x4c8052ab40ab0ec60eec7184b7859683426.*....`...KxYh4&
0x4d825a3930bb7fbdd65e98cd4044bc433c0%......e....K.3.
0x4e8a07d12c3a118efdefef6c360bb96b0bc.}.........`....
0x4f85368ad0b77c3b9a47d0bc9744d633bf7Sh..w...}..tMc;.
0x508df833d7000730ab8fe114701641b5121..=p.s....G.d.Q!
0x518dbbfdf6a0854b05005ec0bc07520fdf6...j.T.P....u ..
0x528b2ddfb5050ff35350c8f080a1c5f5679...PP.55....._Vy
0x538fbdd4d190f8ee0a31983f85c91b8fc3b..M........\...;
0x548d9c10ec3707228388ef85e5e76605b31....pr(8..^^v`[1
0x5585070f25524c3b5cbbec9321041eb37e8Pp.U$.....2.A.7.
0x568d9defeffff0a64678b162c008b0482c3......dg..,.....
0x57890558bec83c4a4b824d115535657b8b0.U......$..SVW..
0x588dced233ed8bf14b884110d8b55dcffc1..#>........U...
0x598dd218915892303378b4d08890d5c2a1b.!...#.7.M...\*.
0x5a8fef21b3d062c68d01a410166c745c808...=.,h..A.f.E..
⋯3 more rows
0x87f000000000000000000000000000000000................
0x88000348b7394eaa4c930c35d01367799ef6.H.9N.L..5..gy..
0x8810100aa1222446d007ad4c0e06503a06dc..."$F...L..P:..
0x88200dcbbe79c2f93c6cf8d2e145dea66bfb...y..<l...E..k.
0x884078f17113f8dde46b271d25bf5eecef67x.q....k'.%.^..g
0x8850a6d553e1dfb182a360b30cb4c1fe96fa..S.....`.......
0x8860b5accc06da49e8d12ad3d981571fee4d.....I..*...W..M
0x8870a8afd8c9e7dd7fa307862bb5806ead91..........+..n..
0x88800dc5d787ef3933d5d8dc47d2b6f03d20.....93...G...=
0x8890643dae7cf8bde0db824f15280e982a15d=.|.....O.(..*.
0x88a00a7afa09c858c858127737a8b1281799.z...X.X.w7..(..
0x88b01a9bcb8732dc5be29515e170a1752501....2.[....p.u%.
0x88c0a98e7e748f0708207a0d52eae6323348..~t... z.R..23H
0x88d0b71ffc0337c29b1fef7fd8eb7d26f657....7.......}&.W
0x88e0bf1a8bf4e30463c17163a9dba6e69cfd......c.qc......
0x88f040f7dd744b71d2d532150f4c01cd6b9b@..tKq..2..L..k.
0x89004880bd9dd085e61234d0cbaceabe69c7H.......4.....i.
0x891020e5d946928b4e0b205f51c82984b3ed ..F..N. _Q.)...
0x8920b1b0990868eae2601c216282405ddf66....h..`.!b.@].f
0x8930d86d7960d70e8f6b2e8141f1c8792951.my`...k..A..y)Q
0x8940e5d0a222b931893f1a44bb8dfe36c433...".1.?.D...6.3
0x895059195ed144eba620b2a661baf4079413Y.^.D.. ..a.....
0x896059468ac8f8a89e407edf8d8c8681bb4aYF.....@~......J
0x89702827f96a103c39e312c726b31f0ab9e3('.j.<9...&.....
0x8980e957d1af5673abb86bf84ae926c213df.W..Vs..k.J.&...
0x8990a6911d7e42f9adfa8d0b1cf01febaadc...~B...........
0x89a056c99a023f243755341188454717c82fV...?$7U4..EG../
0x89b02257c2b1556bce3435806b6235ed081f"W..Uk.45.kb5...
0x89c0764127078745f564d8f8f08e468addd5vA'..E.d....F...
0x89d0ddb52695de262a9711faba17d789fb45..&..&*........E
0x89e019d2ea9c22a3df0b8139e12106dd3998...."....9.!..9.
0x89f01406cf72229a5c32648768026e3a11d4...r".\2d.h.n:..
0x8a00eedeb7a12303d5d2f4b3a8de6fa94ecf....#.......o.N.
0x8a104b48334627ea8c436d064211501c66fcKH3F'..Cm.B.P.f.
0x8a20bd0f9ec76d013ad7dac12c5bed707f04....m.:...,[.p..
0x8a3099ca7f742c80c8dc1df226047e43717d...t,.....&.~Cq}
0x8a4021294c5ca4c3517ffbb725d7deb5402d!)L\..Q...%...@-
0x8a5004ca958f10d3357f457daf1e85e23f24......5.E}....?$
0x8a60986b0ce9b80a8ae9cef194ffc9173151.k............1Q
0x8a70094f854b9ade70534e1b9734fa52cbf9.O.K..pSN..4.R..
0x11fc000000000000000000000000000000000................
0x11fd000000000000000000000000000000000................
0x11fe000000000000000000000000000000000................
0x11ff000000000000000000000000000000000................
0x120004d5a50000200000004000f00ffff0000MZP.............
0x12010b80000000000000040001a0000000000........@.......
0x1202000000000000000000000000000000000................
0x1203000000000000000000000000000020000................
0x12040ba10000e1fb409cd21b8014ccd219090........!..L.!..
0x12050546869732070726f6772616d206d7573This program mus
0x12060742062652072756e20756e6465722057t be run under W
0x12070696e33320d0a24370000000000000000in32..$7........
0x1208000000000000000000000000000000000................
0x120900000000000000000000000000000 ..............
0x1f06c7b87601253979e18b41fa5050e40441f{.`.S........@D.
0x1f07c3abe9dfef1e208e2fbba970a7cd5ae7c:...........|..|
0x1f08c1e1d073d051336baecc726b293247f59...=..6...&..$.Y
0x1f09c322c9f681e35dafe19fbde5c0c8f41c12,.h.5.....\..A.
0x1f0ac258cf6c833feb0f4c71dec1c7a735b6e%...3.......zs[n
0x1f0bcd628a30895a65fa820f39188a6008e36.(...._. ......6
0x1f0cc87f10b166a04002a271c9baac253e5cb....j..*'....S..
0x1f0dc13b9c7c61e64665a2e8277262cc48cef.....dfZ..w&,...
0x1f0ec57af8fcc7cb0345078b86e261f0de509W...|.4Px.n&....
0x1f0fcc69698d4237b577b5c8eb931b5374b97....#{W{\..1.7K.
0x1f10ce89840ebb3908bca3c0417f6e2648439..@.....<....d.9
0x1f11c26be068d43b16116fa772d2d8fcec718&...C.a..w--....
0x1f12cdc66cfaaf977ac379f76afe5ca3ea518.f...w.7.v...>..
0x1f13c04897120205a4c169278af45b13c2cdd..q ZL..x.E.<,.
0x1f14c0418f1b3c8908f4a6a782a07e54e470b.......Jjx*..NG.
0x1f15cd5b38ff228c0bf70e0b80ab5971a445a....(..p......DZ
0x1f16ce3850a31c7c86418a9df979cb038e5d0...1..d......8..
0x1f17c08892c8e2ab682b9eee8eb6b6a42 ..,.*......kjB
⋯3 more rows
0x2e800000000000000000000000000000000................
0x2f855505830000000000050010000100000UPX0.....P......
0x30800000000000400000000000000000000................
0x31800000000800000e05550583100000000........UPX1....
0x32800900000006001000082000000040000.....`..........
⋯11 more rows
0x3e82c8f8ba8fccf1ccba6b90100977e0000,............~..
0x3f800280100260600aeb93bb2fd0020c430.(..&....;... .0
0x408400005d8eb340b009437bfff73f3a037@....4...7..s..7
0x41801bc3ae80600406e20704a23ff53dcdc..:...@n pJ#.S..
0x428fc3ea45a05385d05b06604b864eff3f9.>.Z.8]..f..d...
0x438dc0ad874f07c0c78d081479f9bbbdfdc...t.|.x..G.....
0x4488805ec8d0b032c9002a8959097fbfd3e......,........>
0x458771d06c49c949e0538a059bca195cff3w.......8.Y.....
0x468b9b91478a41548a6a0a6e0007e7fdf91...x..H.....~...
0x4789c5c4805ac9501a3500b2a5477e4fbf9.\H.....P.*Tw...
0x48895500078676bb4e0950bff7fb1e71096.P.xgk..........
0x4984c5f00eb1066623a432b2b484f4fdd7dL_...fb:C++HOO.}
0x4a877fb4b90e998d017a18b04c1e002a38fw.K.............
0x4b807526a00bedd5ddbf7b39e130637ac5a.Rj...]......7.Z
0x4c8052ab40ab0ec60eec7184b7859683426.*....`...KxYh4&
0x4d825a3930bb7fbdd65e98cd4044bc433c0%......e....K.3.
0x4e8a07d12c3a118efdefef6c360bb96b0bc.}.........`....
0x4f85368ad0b77c3b9a47d0bc9744d633bf7Sh..w...}..tMc;.
0x508df833d7000730ab8fe114701641b5121..=p.s....G.d.Q!
0x518dbbfdf6a0854b05005ec0bc07520fdf6...j.T.P....u ..
0x528b2ddfb5050ff35350c8f080a1c5f5679...PP.55....._Vy
0x538fbdd4d190f8ee0a31983f85c91b8fc3b..M........\...;
0x548d9c10ec3707228388ef85e5e76605b31....pr(8..^^v`[1
0x5585070f25524c3b5cbbec9321041eb37e8Pp.U$.....2.A.7.
0x568d9defeffff0a64678b162c008b0482c3......dg..,.....
0x57890558bec83c4a4b824d115535657b8b0.U......$..SVW..
0x588dced233ed8bf14b884110d8b55dcffc1..#>........U...
0x598dd218915892303378b4d08890d5c2a1b.!...#.7.M...\*.
0x5a8fef21b3d062c68d01a410166c745c808...=.,h..A.f.E..
⋯3 more rows
0x87f000000000000000000000000000000000................
0x88000348b7394eaa4c930c35d01367799ef6.H.9N.L..5..gy..
0x8810100aa1222446d007ad4c0e06503a06dc..."$F...L..P:..
0x88200dcbbe79c2f93c6cf8d2e145dea66bfb...y..<l...E..k.
0x884078f17113f8dde46b271d25bf5eecef67x.q....k'.%.^..g
0x8850a6d553e1dfb182a360b30cb4c1fe96fa..S.....`.......
0x8860b5accc06da49e8d12ad3d981571fee4d.....I..*...W..M
0x8870a8afd8c9e7dd7fa307862bb5806ead91..........+..n..
0x88800dc5d787ef3933d5d8dc47d2b6f03d20.....93...G...=
0x8890643dae7cf8bde0db824f15280e982a15d=.|.....O.(..*.
0x88a00a7afa09c858c858127737a8b1281799.z...X.X.w7..(..
0x88b01a9bcb8732dc5be29515e170a1752501....2.[....p.u%.
0x88c0a98e7e748f0708207a0d52eae6323348..~t... z.R..23H
0x88d0b71ffc0337c29b1fef7fd8eb7d26f657....7.......}&.W
0x88e0bf1a8bf4e30463c17163a9dba6e69cfd......c.qc......
0x88f040f7dd744b71d2d532150f4c01cd6b9b@..tKq..2..L..k.
0x89004880bd9dd085e61234d0cbaceabe69c7H.......4.....i.
0x891020e5d946928b4e0b205f51c82984b3ed ..F..N. _Q.)...
0x8920b1b0990868eae2601c216282405ddf66....h..`.!b.@].f
0x8930d86d7960d70e8f6b2e8141f1c8792951.my`...k..A..y)Q
0x8940e5d0a222b931893f1a44bb8dfe36c433...".1.?.D...6.3
0x895059195ed144eba620b2a661baf4079413Y.^.D.. ..a.....
0x896059468ac8f8a89e407edf8d8c8681bb4aYF.....@~......J
0x89702827f96a103c39e312c726b31f0ab9e3('.j.<9...&.....
0x8980e957d1af5673abb86bf84ae926c213df.W..Vs..k.J.&...
0x8990a6911d7e42f9adfa8d0b1cf01febaadc...~B...........
0x89a056c99a023f243755341188454717c82fV...?$7U4..EG../
0x89b02257c2b1556bce3435806b6235ed081f"W..Uk.45.kb5...
0x89c0764127078745f564d8f8f08e468addd5vA'..E.d....F...
0x89d0ddb52695de262a9711faba17d789fb45..&..&*........E
0x89e019d2ea9c22a3df0b8139e12106dd3998...."....9.!..9.
0x89f01406cf72229a5c32648768026e3a11d4...r".\2d.h.n:..
0x8a00eedeb7a12303d5d2f4b3a8de6fa94ecf....#.......o.N.
0x8a104b48334627ea8c436d064211501c66fcKH3F'..Cm.B.P.f.
0x8a20bd0f9ec76d013ad7dac12c5bed707f04....m.:...,[.p..
0x8a3099ca7f742c80c8dc1df226047e43717d...t,.....&.~Cq}
0x8a4021294c5ca4c3517ffbb725d7deb5402d!)L\..Q...%...@-
0x8a5004ca958f10d3357f457daf1e85e23f24......5.E}....?$
0x8a60986b0ce9b80a8ae9cef194ffc9173151.k............1Q
0x8a70094f854b9ade70534e1b9734fa52cbf9.O.K..pSN..4.R..
0x11fc000000000000000000000000000000000................
0x11fd000000000000000000000000000000000................
0x11fe000000000000000000000000000000000................
0x11ff000000000000000000000000000000000................
0x120004d5a50000200000004000f00ffff0000MZP.............
0x12010b80000000000000040001a0000000000........@.......
0x1202000000000000000000000000000000000................
0x1203000000000000000000000000000020000................
0x12040ba10000e1fb409cd21b8014ccd219090........!..L.!..
0x12050546869732070726f6772616d206d7573This program mus
0x12060742062652072756e20756e6465722057t be run under W
0x12070696e33320d0a24370000000000000000in32..$7........
0x1208000000000000000000000000000000000................
0x120900000000000000000000000000000 ..............
0x1f06c7b87601253979e18b41fa5050e40441f{.`.S........@D.
0x1f07c3abe9dfef1e208e2fbba970a7cd5ae7c:...........|..|
0x1f08c1e1d073d051336baecc726b293247f59...=..6...&..$.Y
0x1f09c322c9f681e35dafe19fbde5c0c8f41c12,.h.5.....\..A.
0x1f0ac258cf6c833feb0f4c71dec1c7a735b6e%...3.......zs[n
0x1f0bcd628a30895a65fa820f39188a6008e36.(...._. ......6
0x1f0cc87f10b166a04002a271c9baac253e5cb....j..*'....S..
0x1f0dc13b9c7c61e64665a2e8277262cc48cef.....dfZ..w&,...
0x1f0ec57af8fcc7cb0345078b86e261f0de509W...|.4Px.n&....
0x1f0fcc69698d4237b577b5c8eb931b5374b97....#{W{\..1.7K.
0x1f10ce89840ebb3908bca3c0417f6e2648439..@.....<....d.9
0x1f11c26be068d43b16116fa772d2d8fcec718&...C.a..w--....
0x1f12cdc66cfaaf977ac379f76afe5ca3ea518.f...w.7.v...>..
0x1f13c04897120205a4c169278af45b13c2cdd..q ZL..x.E.<,.
0x1f14c0418f1b3c8908f4a6a782a07e54e470b.......Jjx*..NG.
0x1f15cd5b38ff228c0bf70e0b80ab5971a445a....(..p......DZ
0x1f16ce3850a31c7c86418a9df979cb038e5d0...1..d......8..
0x1f17c08892c8e2ab682b9eee8eb6b6a42 ..,.*......kjB
⋯5 more rows
0x87f000000000000000000000000000000000................
0x880093be737cc420da0fd4d68d342329853d..s|. .....4#).=
0x8810a6f88785ac76e0fb7dbb69c580b47911.....v..}.i...y.
0x882093722619aa8f11d00449d9981a427142.r&......I...BqB
0x88306780f75f9401b0adc0513880596733c6g.._.....Q8.Yg3.
0x8840eac557b4c891c634773a35fcdc93712a..W....4w:5...q*
0x88508a785c401bd049f428cca0dfeff9d453.x\@..I.(......S
0x8860a5b2f7c95c29f95ff6fa6ca7b31b943d....\)._..l....=
0x8870cc7e9ddf4ddf711767e67f04f00bb687.~..M.q.g.......
0x888093de44b54d793ed6b46687b44299e801..D.My>..f..B...
0x8890b671a2eb72eceada346a362290dfa032.q..r...4j6"...2
0x88a0a4a0ef75847303c58079b76cdfd6cbf2...u.s...y.l....
0x88b0ba1ed560f8351b3b31eec7c235b1eb88...`.5.;1...5...
0x88c0c1179805816583fa4e80185fb4d1f54d.....e..N.._...M
0x88d0b78c81b7db7b3f6bebf092e95d4d420b.....{?k....]MB.
0x88e0cfbd6aa579a2b0a1913d02779ca0607c..j.y....=.w..`|
0x88f00afbc1eff5308115b4b5bc10fd6c7a19.....0.......lz.
0x8900fa10dea5802a2a2c6637462a7856d492.....**,f7F*xV..
0x8910261d25b338e4e2bad88694fc4beb93d4&.%.8.......K...
0x8920f985d1d00a2b4efe72eca6342a59990d.....+N.r..4*Y..
0x89309cbc37c3b3af9e8bfcf6bd95b89a4a41..7...........JA
0x89407394714583a743fade216e39d021c39cs.qE..C..!n9.!..
0x8950bd1b50d88e4a0111c4a906896a8e3564..P..J......j.5d
0x8960ad979fcfccc3a277249e5d28c2e431a7.......w$.](..1.
0x8970b4303ad8047aac9848a7f3c9a74aa45e.0:..z..H....J.^
0x89807512ce0b8ab196919315db41703ac4acu..........Ap:..
0x8990a4861c8882c1d6c8c745d20cf782b23b.........E.....;
0x89a0f22eee4a35272b9b2a5078eb199541e5...J5'+.*Px...A.
0x89b0e29f106da3596e27675cc47d9bd0cabe...m.Yn'g\.}....
0x89c034f5ee2d3b86a00088fdfcabb8e96fb74..-;.........o.
0x89d0bfffb8c250c4ef874b3a79b0ad39c6b8....P...K:y..9..
0x89e0f5e7a3df247a50671bbf06af4a1d9ff9....$zPg....J...
0x89f06ca239cdaa3a42cc7c5a3e38fefce06al.9..:B.|Z>8...j
0x8a00e803a04cc33a846600f7dedd7dd80922...L.:.f....}.."
0x8a102ff071e1a762b091afc1793c283c5979/.q..b....y<(<Yy
0x8a20b14dab335d6432c7b8db390ffbcd1fdf.M.3]d2...9.....
0x8a3031b5b7b18c1ae9fee1ab434c00a226e91.........CL..&.
0x8a402924016800dcf23e59dad40796ec6421)$.h...>Y.....d!
0x8a5068288d3462934e02d50f9ad989ea125fh(.4b.N........_
0x8a605e5209bb3025a92490bc1a31d951ed99^R..0%.$...1.Q..
0x8a70ad2e9b18e01cde84b83ec700360d6b2e.........>..6.k.
0x8a807c2680983314badb9f46f829192e0f72|&..3....F.)...r
0x8a908e5b498a25be248146db788dccac37bb.[I.%.$.F.x...7.