9b64e7b46204d935566985632bbc06c8ec3297c457f141f84ca095f51c7f7c88[.]exe[.]zip

General

Target

9b64e7b46204d935566985632bbc06c8ec3297c457f141f84ca095f51c7f7c88.exe.zip
Size

4.3MB
MD5

263d536711f55f7eedf1e9822a638ab2
SHA1

34333d3b3722ef0c0f54d1b56c8b4b2475781677
SHA256

2c6df504c5088b4abb51c600010d4876029800652a526bdfc24a90cd2f85f7f2
SHA512

35464081cd5f391af41608944a91c292bbc167211f7abb106150ba83ff8da59950daf5ec7132f7366b130cda264f891fe126cfc3a042c3fc8384db9181b699f8
SSDEEP

49152:O4d1um6nGdKWTICCegMOZIoOnFulrN3ukX2qIWFTkSP9srtZa+u57bPvlpxFWbmX:O8uiEx/D60uJqIMP98Za+u5fBv14vzo

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/9b64e7b46204d935566985632bbc06c8ec3297c457f141f84ca095f51c7f7c88.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9b64e7b46204d935566985632bbc06c8ec3297c457f141f84ca095f51c7f7c88.exe
unpack002/out.upx

Files

9b64e7b46204d935566985632bbc06c8ec3297c457f141f84ca095f51c7f7c88.exe.zip
.zip

Password: infected
9b64e7b46204d935566985632bbc06c8ec3297c457f141f84ca095f51c7f7c88.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 372KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 619KB - Virtual size: 618KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 4.7MB

UPX1 Size: 372KB - Virtual size: 376KB

.rsrc Size: 4.1MB - Virtual size: 4.1MB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 619KB - Virtual size: 618KB

.rdata Size: 191KB - Virtual size: 190KB

.data Size: 18KB - Virtual size: 28KB

.rsrc Size: 4.1MB - Virtual size: 4.1MB

.reloc Size: 29KB - Virtual size: 29KB

UPX0
Size: - Virtual size: 4.7MB

UPX1
Size: 372KB - Virtual size: 376KB

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

.text
Size: 619KB - Virtual size: 618KB

.rdata
Size: 191KB - Virtual size: 190KB

.data
Size: 18KB - Virtual size: 28KB

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

.reloc
Size: 29KB - Virtual size: 29KB