45231567651ca0d9681a86cfb53dea109285ff5ab8257899b2e8c7b2801da1f1[.]exe[.]zip

General

Target

45231567651ca0d9681a86cfb53dea109285ff5ab8257899b2e8c7b2801da1f1.exe.zip
Size

544KB
MD5

438f7abfefd286fb687d07874e7148d9
SHA1

8ff8e4251e5298848a73c60850587f38caf9bbfa
SHA256

bdd3acb522bd993f96279bd4a05b6e338225b809c1c8c51aee399b0dfe904181
SHA512

69769d7a8252c5e511c9a9a69e33ade2e92bc8e7c3ef5c6ecdf1da6643e231b73a291ad81493c9a83f301495e29e871feaedbebd635ecb4cef05d1a4e09bd0c4
SSDEEP

12288:s3J9KRqcS6rN6XM1a+p7/KnkajMWIAoALd3Stc4HfX7:s3uRqckXMvRKnk48AJ3Sc4Hz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/45231567651ca0d9681a86cfb53dea109285ff5ab8257899b2e8c7b2801da1f1.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/45231567651ca0d9681a86cfb53dea109285ff5ab8257899b2e8c7b2801da1f1.exe
unpack002/out.upx

Files

45231567651ca0d9681a86cfb53dea109285ff5ab8257899b2e8c7b2801da1f1.exe.zip
.zip

Password: infected
45231567651ca0d9681a86cfb53dea109285ff5ab8257899b2e8c7b2801da1f1.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 808KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 343KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 291KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 567KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 808KB

UPX1 Size: 343KB - Virtual size: 344KB

.rsrc Size: 291KB - Virtual size: 292KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 567KB - Virtual size: 567KB

.rdata Size: 184KB - Virtual size: 184KB

.data Size: 20KB - Virtual size: 35KB

.rsrc Size: 298KB - Virtual size: 298KB

.reloc Size: 28KB - Virtual size: 28KB

UPX0
Size: - Virtual size: 808KB

UPX1
Size: 343KB - Virtual size: 344KB

.rsrc
Size: 291KB - Virtual size: 292KB

.text
Size: 567KB - Virtual size: 567KB

.rdata
Size: 184KB - Virtual size: 184KB

.data
Size: 20KB - Virtual size: 35KB

.rsrc
Size: 298KB - Virtual size: 298KB

.reloc
Size: 28KB - Virtual size: 28KB