1016eeb9a592121da7abbf37dd0d7754 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1016eeb9a592121da7abbf37dd0d7754
Size

18KB
MD5

1016eeb9a592121da7abbf37dd0d7754
SHA1

189f50925a41cd56db81f058e935d7b04ff5f2c1
SHA256

817e637acabe226a97738f4812e2d92289461aa928e26e35507ba56de5f38005
SHA512

22bba64bf2996fa0b66172516bf498cd07a2de288f87d38f8571efdc95cddac3558a25afcb00e483737d467e40e75b2332813b46470bd1a7263eba2885b7db88
SSDEEP

48:Sz6bDawkzTamhjHrsbz7D0ku+BP7d4lN4qcU0AMuWqhvnpY4oopo:8wy1hjKK+xOlSe0KWS/pYp3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1016eeb9a592121da7abbf37dd0d7754

Files

1016eeb9a592121da7abbf37dd0d7754
.dll windows:5 windows x86 arch:x86

6f21eb37e1c460ef724fe8171b735fb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetFileSize
lstrcpynA
FreeLibrary
Process32First
OpenProcess
Sleep
ReadFile
lstrcatA
lstrcmpiA
GetProcAddress
LoadLibraryA
Process32Next
CreateThread
GetCurrentThreadId
CloseHandle
GetVersion
GetTempPathA
DeleteFileA
CreateToolhelp32Snapshot

advapi32

OpenProcessToken
CreateProcessAsUserA

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
strstr
memset

user32

GetThreadDesktop
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA

Sections

UPX0
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE