d9509404580ce24e56a59b1f7107ed42e6cfe2b851a0fad12e2a37392b1df6f3[.]exe[.]zip

General

Target

d9509404580ce24e56a59b1f7107ed42e6cfe2b851a0fad12e2a37392b1df6f3.exe.zip
Size

785KB
MD5

345596227e97297c6b1c8178b69c4e4d
SHA1

5fc5a440f8413c02a1ad2d7dfe9d567a2e6e6b39
SHA256

42932f5301f599593f3688455b1e63c5c507522683c0b8198387e776d6bc3596
SHA512

38bf714470ce736eaafae88e45c3090692beea820e8a5fdf6affb0f0cddb3953c54af3615ede5dae0fd5a3ed05e7b011e79620bc32bd7cd74249c27be3d12965
SSDEEP

12288:z0xQgv5krU8ANrQj/ygThnVNqT4xrVwRLz9L1zk2CsvTs+LVy5ksbk4hzTulLHQt:YfiFD79nvwH9J1nLVy5k4k4wNw5X

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/d9509404580ce24e56a59b1f7107ed42e6cfe2b851a0fad12e2a37392b1df6f3.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d9509404580ce24e56a59b1f7107ed42e6cfe2b851a0fad12e2a37392b1df6f3.exe
unpack002/out.upx

d9509404580ce24e56a59b1f7107ed42e6cfe2b851a0fad12e2a37392b1df6f3.exe.zip
.zip

Password: infected
d9509404580ce24e56a59b1f7107ed42e6cfe2b851a0fad12e2a37392b1df6f3.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 332KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 220KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ