0daf4a33ac809c21fe622461d7ad3fbe510787ee4361be922663e0676c29002a[.]exe[.]zip

General

Target

0daf4a33ac809c21fe622461d7ad3fbe510787ee4361be922663e0676c29002a.exe.zip
Size

91.9MB
MD5

426e2d2eb143f73d0dcd308be985bfcf
SHA1

5c50c9813e0b1bbd8b9b6fc88f32f7b99ea55fc7
SHA256

99e41d1baef5d08887c63c767c8c511ffef1fc2dc3325dfe978a6ee40a8a50f3
SHA512

64f1bca0ed956b0162fb5c7797715308d9a0e76d96754b614abac5478a72304a5fd4f3a23f9a707e59c955326c6e53541f5ba400b566836076411e305a738fb8
SSDEEP

1572864:ujFCSXNusYmOvf9VIxTTjF5Edim3eCZfcuZz43j5CeWYJJFZgR1zDJMt5iW6kURY:M/OSvjF9e1ZM3j5CevFZWcx/UbmMze

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/0daf4a33ac809c21fe622461d7ad3fbe510787ee4361be922663e0676c29002a.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0daf4a33ac809c21fe622461d7ad3fbe510787ee4361be922663e0676c29002a.exe

0daf4a33ac809c21fe622461d7ad3fbe510787ee4361be922663e0676c29002a.exe.zip
.zip

Password: infected
0daf4a33ac809c21fe622461d7ad3fbe510787ee4361be922663e0676c29002a.exe
.exe windows:1 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 284KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE