2932e1766d707b5873575d949c4670fde38587763bd54fe6eb0ab6119ddfc54d[.]zip[.]zip

General

Target

2932e1766d707b5873575d949c4670fde38587763bd54fe6eb0ab6119ddfc54d.zip.zip
Size

167KB
MD5

8c024126437a95280183f957ee866f81
SHA1

6ef283830fc829b7cae901bf63ec430d809d2b8d
SHA256

4c15e39737979cca5bbb41666a5687186104965ace21c718f5d93c8f1e32e24f
SHA512

6415fc17a063959349423a4d546bb47232934ac40992a15b805cfa59b6a718b5ed14ca54d81463f52ef5d95f6d6829b06785e96b75066440af49fbc82e6aaf3e
SSDEEP

3072:vQDjt1SjhudjfMaT363rspU0XdxJW1DNh11z/2QQH8SUsr3RxO7/Of5asLOhn382:2SjhudjfDT36rwdS1hh1h2QvdsoO5aIO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack002/DLookup.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/DLookup.exe

2932e1766d707b5873575d949c4670fde38587763bd54fe6eb0ab6119ddfc54d.zip.zip
.zip

Password: infected
2932e1766d707b5873575d949c4670fde38587763bd54fe6eb0ab6119ddfc54d.zip
.zip
DLookup.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 292KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 166KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE