de80c8950f575234984a369a734260e82bed4c791db5bc2c89d99392fa7f81f9[.]exe[.]zip

General

Target

de80c8950f575234984a369a734260e82bed4c791db5bc2c89d99392fa7f81f9.exe.zip
Size

8.2MB
MD5

54b0302b1df64b284867434509efca47
SHA1

388dcd0e581337147550d65a7292584d6056daa9
SHA256

72c44ebbcf6400f402e21413cfb849ee1d621b82ae4a9001301de8728f1b96f2
SHA512

086fc3491cda3aa58dd2cc7191c24a000046cd67f670a35f20495975592348696d60122a0367965f7e37192cbdf33ff33ca20f1cd8363685b3257a2c779c9269
SSDEEP

196608:6rRhi44o/VdlPi2BpzX0PJfUBQAN1YvaRC:1L0Pti2XX0PJfU31BC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/de80c8950f575234984a369a734260e82bed4c791db5bc2c89d99392fa7f81f9.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/de80c8950f575234984a369a734260e82bed4c791db5bc2c89d99392fa7f81f9.exe

de80c8950f575234984a369a734260e82bed4c791db5bc2c89d99392fa7f81f9.exe.zip
.zip

Password: infected
de80c8950f575234984a369a734260e82bed4c791db5bc2c89d99392fa7f81f9.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE