ca7989d8c5f65c313079e7f8fb7710886c5eb2f8313e734d986e5b616651ebad[.]exe[.]zip

General

Target

ca7989d8c5f65c313079e7f8fb7710886c5eb2f8313e734d986e5b616651ebad.exe.zip
Size

3.5MB
MD5

5a63333424f3faaab61af6c329d3f094
SHA1

01a2c55d29fe16f47d0d65eee5d9b8f0ebfbc15f
SHA256

381ee186fdefb1749dd62928c505a1afffd71b7f19f39246dc7484928cfe2d6f
SHA512

aafb69fd20d9d7ca0999c75dae6fe8923b0a5db79cd93d239e47d83dbae3a3a314419e73cdd4c9b8b6a42f23be97876afc1d3c654e2c29bc6ab7442e88bb87fd
SSDEEP

98304:0ITzgF++117RrlUepJoF6tlPUZzLEP8EkgcXFr4a:0I+37RrlUo2F6tl8drrzXma

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/ca7989d8c5f65c313079e7f8fb7710886c5eb2f8313e734d986e5b616651ebad.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ca7989d8c5f65c313079e7f8fb7710886c5eb2f8313e734d986e5b616651ebad.exe

ca7989d8c5f65c313079e7f8fb7710886c5eb2f8313e734d986e5b616651ebad.exe.zip
.zip

Password: infected
ca7989d8c5f65c313079e7f8fb7710886c5eb2f8313e734d986e5b616651ebad.exe
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE