df80c14acce395633480a732a05a4f98b1a5105ceda18718776585f445dbb1fb[.]exe[.]zip

General

Target

df80c14acce395633480a732a05a4f98b1a5105ceda18718776585f445dbb1fb.exe.zip
Size

65.0MB
MD5

881b295365b53ec06da6aa3c8c96e59e
SHA1

b3d6873351446ac8bdf135e5e27e07dac114aee1
SHA256

309953b67648498d7935b44058b2585275737191b41500ad45bea1bd8c6c75ba
SHA512

209692a594404433f79b1d407f8c8c1809dd64ab5d0a304574a6bb9021d3170a5bec414f60e43cd131519f6887a1d662475f61e4400b130d578920662626ace5
SSDEEP

1572864:xhRGk4XGTgKimrOvri78OkYTCNOltHPakX+r/ijyu+NuX:xOmJC0ltHPB1V+NuX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/df80c14acce395633480a732a05a4f98b1a5105ceda18718776585f445dbb1fb.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/df80c14acce395633480a732a05a4f98b1a5105ceda18718776585f445dbb1fb.exe

df80c14acce395633480a732a05a4f98b1a5105ceda18718776585f445dbb1fb.exe.zip
.zip

Password: infected
df80c14acce395633480a732a05a4f98b1a5105ceda18718776585f445dbb1fb.exe
.exe windows:1 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 284KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE