dc8a5538cd137d2da7dca94c8f34919385e6095b48bc49639d9453d39d8c36bb

Sharing

Copy URL Twitter E-mail

General

Target

dc8a5538cd137d2da7dca94c8f34919385e6095b48bc49639d9453d39d8c36bb
Size

845KB
MD5

9fcb65e2f1aa57ff25e275a69aa757de
SHA1

0102438392dddb1306024ccd10f7aa611f87fd8b
SHA256

dc8a5538cd137d2da7dca94c8f34919385e6095b48bc49639d9453d39d8c36bb
SHA512

8d870b9bf79dc949ca6cb8c2da96335f5b82e0245d20ac1da88c600daf9ccc879825652a1a73166f8844c18d130d68999443adf02913136287506bee8b2f6b14
SSDEEP

24576:G+ng6pEqNVNyVy/tv2dLxP3m2V516Q316TZ:HgmEg3yOvImQ16+169

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Zdxwzzs/伪装文件专杀/伪装文件专杀.exe	upx

Files

dc8a5538cd137d2da7dca94c8f34919385e6095b48bc49639d9453d39d8c36bb
.rar
Zdxwzzs/伪装文件专杀/Info.zdx
Zdxwzzs/伪装文件专杀/Skin/File.ico
Zdxwzzs/伪装文件专杀/Skin/Image.ico
Zdxwzzs/伪装文件专杀/Skin/Music.ico
Zdxwzzs/伪装文件专杀/Skin/Office.ico
Zdxwzzs/伪装文件专杀/Skin/Safe.ico
Zdxwzzs/伪装文件专杀/Skin/Video.ico
Zdxwzzs/伪装文件专杀/bdk.ini
Zdxwzzs/伪装文件专杀/伪装文件专杀.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 716KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 375KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 504KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 292KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Zdxwzzs/伪装文件专杀/图标/伪装AVI视频16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装AVI视频24-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装AVI视频32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装AVI视频32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装AVI视频48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装AVI视频48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片16-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片16-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片32-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装GIF图片Shimgvw.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片16-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片16-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片32-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装JPEG图片Shimgvw.ico
Zdxwzzs/伪装文件专杀/图标/伪装MP3音乐16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MP3音乐24-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MP3音乐32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MP3音乐32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装MP3音乐48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MP3音乐48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装MPEG视频16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MPEG视频24-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MPEG视频32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MPEG视频32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装MPEG视频48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装MPEG视频48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装Office11.ico
Zdxwzzs/伪装文件专杀/图标/伪装Office2.ico
Zdxwzzs/伪装文件专杀/图标/伪装Office3.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMA音乐16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMA音乐24-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMA音乐32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMA音乐32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMA音乐48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMA音乐48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMV视频16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMV视频24-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMV视频32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMV视频32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMV视频48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装WMV视频48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片16-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片16-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片32-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片48-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装位图图片Shimgvw.ico
Zdxwzzs/伪装文件专杀/图标/伪装图片1.ico
Zdxwzzs/伪装文件专杀/图标/伪装图片2.ico
Zdxwzzs/伪装文件专杀/图标/伪装图片3.ico
Zdxwzzs/伪装文件专杀/图标/伪装图片4.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1000000.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1000062.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1000079.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1000252.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1000426.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1001489.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1001634.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1001892.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1002768.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1006141.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1008148.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1011073.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1012831.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1012921.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1014125.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1018162.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1020201.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1025642.ico
Zdxwzzs/伪装文件专杀/图标/伪装杀软1030634.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频1.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频16-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频16-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频2.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频3.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频32-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频4.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频48-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频5.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频6.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频Wmplayer.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频WmplayerFile.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式16-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式16-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式32-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式48-16.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装视频格式48-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装音乐16-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装音乐24-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装音乐32-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装音乐32-32.ico
Zdxwzzs/伪装文件专杀/图标/伪装音乐48-256.ico
Zdxwzzs/伪装文件专杀/图标/伪装音乐48-32.ico
Zdxwzzs/伪装文件专杀/图标/文件夹.ico
Zdxwzzs/伪装文件专杀/图标/文件夹1.ico
Zdxwzzs/伪装文件专杀/图标/文件夹16-16-2.ico
Zdxwzzs/伪装文件专杀/图标/文件夹16-16.ico
Zdxwzzs/伪装文件专杀/图标/文件夹16-256.ico
Zdxwzzs/伪装文件专杀/图标/文件夹16-32.ico
Zdxwzzs/伪装文件专杀/图标/文件夹2.ico
Zdxwzzs/伪装文件专杀/图标/文件夹24-256.ico
Zdxwzzs/伪装文件专杀/图标/文件夹24-32.ico
Zdxwzzs/伪装文件专杀/图标/文件夹3.ico
Zdxwzzs/伪装文件专杀/图标/文件夹32-16.ico
Zdxwzzs/伪装文件专杀/图标/文件夹32-256.ico
Zdxwzzs/伪装文件专杀/图标/文件夹32-32.ico
Zdxwzzs/伪装文件专杀/图标/文件夹4.ico
Zdxwzzs/伪装文件专杀/图标/文件夹48-16.ico
Zdxwzzs/伪装文件专杀/图标/文件夹48-256.ico
Zdxwzzs/伪装文件专杀/图标/文件夹48-32.ico
Zdxwzzs/伪装文件专杀/图标/文件夹96-256.ico
Zdxwzzs/伪装文件专杀/图标/文件夹96-32.ico
Zdxwzzs/伪装文件专杀/图标/文件夹Shell32.ico
Zdxwzzs/支持本站.reg

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 716KB

UPX1 Size: 375KB - Virtual size: 376KB

.rsrc Size: 14KB - Virtual size: 16KB

Headers

File Characteristics

Sections

.text Size: 504KB - Virtual size: 500KB

.rdata Size: 292KB - Virtual size: 290KB

.data Size: 64KB - Virtual size: 251KB

.rsrc Size: 32KB - Virtual size: 29KB

UPX0
Size: - Virtual size: 716KB

UPX1
Size: 375KB - Virtual size: 376KB

.rsrc
Size: 14KB - Virtual size: 16KB

.text
Size: 504KB - Virtual size: 500KB

.rdata
Size: 292KB - Virtual size: 290KB

.data
Size: 64KB - Virtual size: 251KB

.rsrc
Size: 32KB - Virtual size: 29KB