2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614[.]exe[.]zip

General

Target

2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe.zip
Size

223KB
MD5

340c1961c4a7d98ee4a7f22f3488b4e8
SHA1

ffd49bba3f3f2c2cf04bcbbed055883d1c9f8864
SHA256

a1949c321737cac40d4db490555d4ab5b1f5b78add555daf5f30828e1672f910
SHA512

71c8add4fd03ea0a8278f9b79716aa9e2d80620cfaa58435d6322d3da1b0fbfce32b5e1672024adc1821f09bc9c5a8a982bebe67d984a592e064eceb7d338074
SSDEEP

6144:xuJPzDMtUvqo17klp/dKEZTtVJKekHz7IWipHL:EJ3YUSohkl6EZPJWT2L

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe
unpack002/out.upx

2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe.zip
.zip

Password: infected
2dbc6ce68daac11751d1dee989bbefc6aa47b4a8658feab9aed5b201fdfea614.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 452KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 188KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 162KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ