17d988b9ecc000974fd26188a165e3b7 | Triage

Sharing

General

Target

17d988b9ecc000974fd26188a165e3b7
Size

43KB
MD5

17d988b9ecc000974fd26188a165e3b7
SHA1

e6a3595c781a7f1f84d1b50a860e5f52fd4ec7eb
SHA256

b6898ec475cbd9d6c396dd58456628dda1ad811a66a03ccdddd6e9f184138d74
SHA512

34ccec3513492fb503755d69bf955901dad5e2590d2698b886eadd8d0148e1218997bfd334410479922ebc1a7eb6788dcd0e11c6b7ed0caf6504c1040e10ec8a
SSDEEP

192:n+s61A/0LivxqfKD6V0tQtWhiQrSTrZg933w7rPdmSMWrAAEYtsmhjcU:lx0ivxqs2Q2m9HWshWrAAEIsmxL

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17d988b9ecc000974fd26188a165e3b7

Files

17d988b9ecc000974fd26188a165e3b7
.exe windows:4 windows x86 arch:x86

8b624c272a0a221d2409aebf073f7cf5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

WinExec
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

urlmon

URLDownloadToFileA

user32

GetKeyboardType
MessageBoxA
CharNextA

Sections

UPX0
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE