51097991bff5f18ba604ce4394d3eecf7c4c9c2747c5a9425c668a307de733c9[.]exe[.]zip

General

Target

51097991bff5f18ba604ce4394d3eecf7c4c9c2747c5a9425c668a307de733c9.exe.zip
Size

793KB
MD5

f936ed479673117b5723495538d859ef
SHA1

109cdd24871ff1b491ac95027d587dda7377daff
SHA256

bdac84149e627cb42021a5eeb33b4cc84e72debecf1db449ef557732e682d3bb
SHA512

495ecc9b30ef23572d059d278ed1e3fac2033d01ecaa20ee99281f5133d3e1fa5d588e849c4fc2dc2256e8f6cc99037f8a8d0439698ec585d1246008d238579b
SSDEEP

12288:zgC2yJiMS0Dv3SfZzAvyU1dwmObv7BJEwOkDF+JzqOzvfN9GJELhoS5jBS0DQ5gP:gy5Sev3RvrYt7BJx8lTjfZ580DyV7Vc

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/51097991bff5f18ba604ce4394d3eecf7c4c9c2747c5a9425c668a307de733c9.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/51097991bff5f18ba604ce4394d3eecf7c4c9c2747c5a9425c668a307de733c9.exe

51097991bff5f18ba604ce4394d3eecf7c4c9c2747c5a9425c668a307de733c9.exe.zip
.zip

Password: infected
51097991bff5f18ba604ce4394d3eecf7c4c9c2747c5a9425c668a307de733c9.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 105KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE