103d9cd29e7fb95f443cfb97e13bd54a1f20b82067ccebb79108f5e57ab1d455[.]exe[.]zip

General

Target

103d9cd29e7fb95f443cfb97e13bd54a1f20b82067ccebb79108f5e57ab1d455.exe.zip
Size

3.5MB
MD5

ff3b92c06e180ed2e1cc4717e27600d7
SHA1

1a63776d3e0dae8cee573e829efc3f6184e934ab
SHA256

e2b61d88af3ddae40ed974668ad16c9767eb137ef0f24bdf1b9eccbbde271ce6
SHA512

7e68885b188617f884a1b0811da009a99b07e3d2680dc92174fb5feab28695d0d9a800aec38788332201b331f36254b3712d043f5d185f870e00cdd39ff29293
SSDEEP

98304:bY73lK6HpQ69sUP/Oaj11QnmGuGEs8/eO6LI:/6m63nXBxG98/eO6s

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/103d9cd29e7fb95f443cfb97e13bd54a1f20b82067ccebb79108f5e57ab1d455.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/103d9cd29e7fb95f443cfb97e13bd54a1f20b82067ccebb79108f5e57ab1d455.exe

103d9cd29e7fb95f443cfb97e13bd54a1f20b82067ccebb79108f5e57ab1d455.exe.zip
.zip .ps1

Password: infected
103d9cd29e7fb95f443cfb97e13bd54a1f20b82067ccebb79108f5e57ab1d455.exe
.exe windows:5 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE