0329dd6929ab62cc6512ca7dfd3c9e3cb2e5a1963e1f75fa1185609020ac01f8[.]zip[.]zip

General

Target
0329dd6929ab62cc6512ca7dfd3c9e3cb2e5a1963e1f75fa1185609020ac01f8.zip.zip
Size 224KB
Sample231107-q8a78sff4z
SHA256 061db8ab447e9f9cb0bdc25daa03dbac2fe17f571df3e0bed057c354b2faacc4
MD5 260de7ff219f56b9773d4ccf8e506922
SHA1 1f5e775029f79b1d5b0cd86eaed6c89dfd5e7930
SHA512 74801d37fe6db19201af85b8df8551aa5289964dfc123ea6fa44daa9b8474792386f22c8064fc7118aaee5c11b5eccba979b114d91377d669d52fd8069c96e6d
SSDEEP 3072:x5a1ZvIy8juE529dYQUPOkgjCKh93d/X7Ci6L7gVQttPuqMjnS9W7mR0MNmqikd7:jaZhE527DJj+K/d/ui0gWTPRenSm3aV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack002/STxt file creator.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/STxt file creator.exe

0329dd6929ab62cc6512ca7dfd3c9e3cb2e5a1963e1f75fa1185609020ac01f8.zip.zip

.zip 224KB
0329dd6929ab62cc6512ca7dfd3c9e3cb2e5a1963e1f75fa1185609020ac01f8.zip

.zip 223KB
LZHUF.EXE

29KB
STxt file creator.exe

.exe 201KB

SHA256 061db8ab447e9f9cb0bdc25daa03dbac2fe17f571df3e0bed057c354b2faacc4
MD5 260de7ff219f56b9773d4ccf8e506922
SHA1 1f5e775029f79b1d5b0cd86eaed6c89dfd5e7930
SHA512 74801d37fe6db19201af85b8df8551aa5289964dfc123ea6fa44daa9b8474792386f22c8064fc7118aaee5c11b5eccba979b114d91377d669d52fd8069c96e6d
SSDEEP 3072:x5a1ZvIy8juE529dYQUPOkgjCKh93d/X7Ci6L7gVQttPuqMjnS9W7mR0MNmqikd7:jaZhE527DJj+K/d/ui0gWTPRenSm3aV
MD5 SHA1 SHA512 SSDEEP

Password

infected

SHA256 b8f31941c206818ebff4ae7592e2b805056cb988fd71fcd3efc0a4a509061d3f
MD5 d8863b1dc9c925dfd30201932bf149fd
SHA1 7b7593857ae4942ffba7a87eb887ef4942cd52fe
SHA512 817582f7b81720cde254171666da6c1b3e3a482ce93c4cb8ec0add00672e515d455a9d87a705b4ddea1800851c20dc403123e71eaa763bc4f3ed321c1ba5cdb9
SSDEEP 6144:qcPGkx5JGj86VeWeY9iwyFcmUSvp1JUWMAXxEtk:5GkxTGY6xeaypOFAXxEt
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

570880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths