495a95943dc8a9a595c463dc71d7c208[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

495a95943dc8a9a595c463dc71d7c208.bin
Size

786KB
MD5

76eb0e73d16cf82120f60361de1fa226
SHA1

5c98a898b39e1ef11a3eb7eb0b8f37a8f376e589
SHA256

5b5728922cac9e95df245b5001980e08dbb7d5fdc155e350138690c553e18958
SHA512

4da3834a1372050eb155ee050e1844ad5b7242e9926e3937ec38bbbac1387ba10c9f7467e9a42c8fb0c71a05f71036613ade74917e341badd63c427d8a6b40ed
SSDEEP

24576:k/vPF9vcBmztbpf77wxIIhRlP57B9Bdx10v:evPF9X7T7wxpvBdb0v

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/845aebecfecdf6c8b8bbaafccb616d3d7dd7fbdaab0cb28084fe16e13fe006b8.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/845aebecfecdf6c8b8bbaafccb616d3d7dd7fbdaab0cb28084fe16e13fe006b8.exe

Files

495a95943dc8a9a595c463dc71d7c208.bin
.zip

Password: infected
845aebecfecdf6c8b8bbaafccb616d3d7dd7fbdaab0cb28084fe16e13fe006b8.exe
.exe windows x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 783KB - Virtual size: 784KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE