8d315e9fc606d81f8359f1b929119ebb3229c6c55982a287333921b12e6fd39a[.]zip[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

8d315e9fc606d81f8359f1b929119ebb3229c6c55982a287333921b12e6fd39a.zip.zip
Size

441KB
MD5

e456d1281755dc71300abae6000faf67
SHA1

217e7d98f9823a9b3a71af635ef7016a2bd9b8fa
SHA256

ddbb6525678970239cf4b45d3beebe0c44190002f3578384064bc04c9a383cd7
SHA512

50c7ebc59761cdcb9ed1a7d4efdd63dfc6826375dcc463e6ec9574f7df63380a30fb008ba19271a667e1a5d0ca554c4aee5a40f07a406862311ca24ef0874929
SSDEEP

12288:7I1T3Hj3ZndU0AU/NJDBjb9ZU6UuQkVlc4yuOhg:7IDdU0AUlJR9+6Uhk7c4yuOhg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/mkisofs.exe	upx
static1/unpack002/slipstreamer.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack004/out.upx	autoit_exe

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack002/dd.exe
unpack002/mkisofs.exe
unpack002/slipstreamer.exe
unpack004/out.upx

Files

8d315e9fc606d81f8359f1b929119ebb3229c6c55982a287333921b12e6fd39a.zip.zip
.zip

Password: infected
8d315e9fc606d81f8359f1b929119ebb3229c6c55982a287333921b12e6fd39a.zip
.zip
README.txt
dd.exe
.exe windows:4 windows x86

64d9aef39f523506361ff18b89009f8e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostname

msvcrt

bsearch
fclose
realloc
fgets
fopen
putc
strerror
vfprintf
fflush
calloc
getenv
qsort
strncpy
_strlwr
_stat
_get_osfhandle
puts
malloc
strrchr
sprintf
_dup
_pipe
_exit
strncmp
signal
fprintf
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_isctype
toupper
__mb_cur_max
_pctype
tolower
strchr
free
_iob
_setmode
_ftol
_fstat
setlocale
_open
_fileno
_lseek
_close
_getpid
_strdup
_getcwd
_read
_write
_access
_utime
_chsize
_unlink
_mktemp
printf
exit
_errno
_XcptFilter
__p___initenv
__getmainargs

kernel32

RaiseException
GetLastError
InterlockedExchange
LocalAlloc
GetVersion
CreateProcessA
GetCurrentProcessId
OpenProcess
TerminateProcess
Sleep
GetExitCodeProcess
GetFullPathNameA
CreateFileA
GetFileInformationByHandle
CloseHandle
GetProcAddress
FreeLibrary
LoadLibraryA

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gpl.txt
lizenz.txt
mkisofs.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 364KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
quellen.txt
slipstreamer.au3
slipstreamer.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 400KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 219KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

64d9aef39f523506361ff18b89009f8e

Headers

File Characteristics

Imports

wsock32

msvcrt

kernel32

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 364KB

UPX1 Size: 124KB - Virtual size: 128KB

UPX2 Size: 512B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 400KB

UPX1 Size: 219KB - Virtual size: 220KB

.rsrc Size: 29KB - Virtual size: 32KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 404KB - Virtual size: 404KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 10KB - Virtual size: 99KB

.rsrc Size: 37KB - Virtual size: 36KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 364KB

UPX1
Size: 124KB - Virtual size: 128KB

UPX2
Size: 512B - Virtual size: 4KB

UPX0
Size: - Virtual size: 400KB

UPX1
Size: 219KB - Virtual size: 220KB

.rsrc
Size: 29KB - Virtual size: 32KB

.text
Size: 404KB - Virtual size: 404KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 10KB - Virtual size: 99KB

.rsrc
Size: 37KB - Virtual size: 36KB