217bfa377896d6bfca48df32071347d5 | Triage

Sharing

General

Target

217bfa377896d6bfca48df32071347d5
Size

50KB
MD5

217bfa377896d6bfca48df32071347d5
SHA1

61f9f2b9a45db19272b634c02d25fe02d6a81d85
SHA256

690bc6187ab2ed2ffa9d796019dcb3d172881368bfa22ff4a149dbb9078a121d
SHA512

69014539f27c928b19780bd3a7bf13d475bcc826269d796d20608c520b70563da664248a40b320859a6a2dc4008d7ad24aff1a53a79fe6a7c9a183ac7b946ab4
SSDEEP

768:Y7UWZR1RgehRgdJj/QCWu1Wdy1d7QBQ5JXJ/HzEbHKEze:Y79L1RVsTj/vq+X5zw

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
217bfa377896d6bfca48df32071347d5

Files

217bfa377896d6bfca48df32071347d5
.exe windows:4 windows x86 arch:x86

c3eb81819942f84a03f7acf9bc151979

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
WriteFile
CreateFileA
CopyFileA
GetModuleFileNameA
GetWindowsDirectoryA
GetProcAddress
CloseHandle
FindClose
FreeLibrary
lstrlenA
FindFirstFileA
GetTickCount
SetCurrentDirectoryA
CreateMutexA
OpenMutexA
GetFileAttributesA

advapi32

RegOpenKeyA
RegCloseKey

user32

wsprintfA
CharLowerA

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE