2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614[.]exe[.]zip

General

Target

2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe.zip
Size

223KB
MD5

19f0db60333af3a4e6bd646109932c48
SHA1

48ad62f28989f85fd788adb5a3c50180645f8828
SHA256

aa487ae5486d252fa6c2023928dff73127987867a9cb6f0b9f6f6a6ea9f69871
SHA512

04415cee3b727a3373746e87f87819e3d0059a1f85ef24f367f3eb38fc084b6ab0aaba12e463c78bce22af716323f8ecb877958224f25fc4e2bc5acdb3e2f99e
SSDEEP

6144:1WV397bfW7U1tvwxw8MgQIVY6sZLvJMKidUPahjsZCig8bH:1WV1bzgfMgQpFMcPkFU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe
unpack002/out.upx

2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe.zip
.zip

Password: infected
2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 452KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 188KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 162KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ