e0d1276048d88a63370a985ffe97b68ae612269e8f3c98a30e6b6e10ebd92c0a[.]exe[.]zip

General

Target

e0d1276048d88a63370a985ffe97b68ae612269e8f3c98a30e6b6e10ebd92c0a.exe.zip
Size

29.2MB
MD5

f4105e28f6a2646326c145dff3e2cfc7
SHA1

68d4b3e40930ef8587cc624c711c1a1a5a8eb895
SHA256

14036ee526abcaa0eb37345dae2a47f9b112b94acc551434f3af482499209e3e
SHA512

331e4e57e002d06df57291d268b4a775a86a88b3993e7d7ce9590e987e327c61da874b4828ad0b6052c6123ff17e5bbca80ab93a02a11c02698b07128da43087
SSDEEP

786432:wrdnED7M3uC0JV5bGdZi5UQAmDfeGrLNn9rjVy5ye:wrdEDweG3iHZDfeGPNn9rZy5ye

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/e0d1276048d88a63370a985ffe97b68ae612269e8f3c98a30e6b6e10ebd92c0a.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e0d1276048d88a63370a985ffe97b68ae612269e8f3c98a30e6b6e10ebd92c0a.exe
unpack002/out.upx

e0d1276048d88a63370a985ffe97b68ae612269e8f3c98a30e6b6e10ebd92c0a.exe.zip
.zip

Password: infected
e0d1276048d88a63370a985ffe97b68ae612269e8f3c98a30e6b6e10ebd92c0a.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 528KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 263KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 91KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ