fab50f8c0bd02bc0960bdbf496ba8be46087f026a84ea92dab6028b9b46a6c50[.]exe[.]zip

General

Target

fab50f8c0bd02bc0960bdbf496ba8be46087f026a84ea92dab6028b9b46a6c50.exe.zip
Size

420KB
MD5

782ee9d07955240b2f724c63db8436b9
SHA1

5c8a287d59f3839a4b3475d708f48815a101a057
SHA256

235ebbc9e9eb2ada31068b96000e30b06cd848e775ed78542a895ec215a8923e
SHA512

3a131d0b75ce93b80028821fa5280519174c2727cfbe040bca582b666df61a28162ce7e077df5fc4e91c222f591942b3df9485373ed7e6244333b465a3364bd9
SSDEEP

12288:ecYLvkIdv1KAp5WgvhC5ogrsoEhdMbwJVQUF6:EvkIdvTpP85ogrsomVQ46

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/fab50f8c0bd02bc0960bdbf496ba8be46087f026a84ea92dab6028b9b46a6c50.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fab50f8c0bd02bc0960bdbf496ba8be46087f026a84ea92dab6028b9b46a6c50.exe
unpack002/out.upx

Files

fab50f8c0bd02bc0960bdbf496ba8be46087f026a84ea92dab6028b9b46a6c50.exe.zip
.zip

Password: infected
fab50f8c0bd02bc0960bdbf496ba8be46087f026a84ea92dab6028b9b46a6c50.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 273KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 154KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 211KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832KB - Virtual size: 831KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.1MB

UPX1 Size: 273KB - Virtual size: 276KB

.rsrc Size: 154KB - Virtual size: 156KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 211KB - Virtual size: 212KB

.rdata Size: 57KB - Virtual size: 60KB

.data Size: 19KB - Virtual size: 32KB

.rsrc Size: 832KB - Virtual size: 831KB

.code Size: 252KB - Virtual size: 252KB

UPX0
Size: - Virtual size: 1.1MB

UPX1
Size: 273KB - Virtual size: 276KB

.rsrc
Size: 154KB - Virtual size: 156KB

.text
Size: 211KB - Virtual size: 212KB

.rdata
Size: 57KB - Virtual size: 60KB

.data
Size: 19KB - Virtual size: 32KB

.rsrc
Size: 832KB - Virtual size: 831KB

.code
Size: 252KB - Virtual size: 252KB