ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9[.]exe[.]zip

General

Target

ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe.zip
Size

72KB
MD5

fb717f755b084b93b92cde726c904604
SHA1

9bfc65a5d6653a73070e033ae03428cae7add578
SHA256

0f453b03bd85e87f357bf6e38a3d7f04c6351240e026c30e172cc748e6a49c14
SHA512

4c5942b45a0da3b56cba528f2b839af3b7df002328e2334841b36fe315ac905c0012dce285ba6ad7cb90a9a36fa54ac253def2d51e2d3a5a2e8c699363991dee
SSDEEP

1536:iaRm3UWDsqJaX2DUoe4TT093Y8AW3Tqo3gVUqHb8OHSpX:3m3UOZJaXro9T0hfTqo3gVUk8OypX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe
unpack002/out.upx

ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe.zip
.zip

Password: infected
ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

VPX1
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ