18efe1ff6e54ee6f595a6271088b62623a7d0a5eca274fc5b31e082161d29671[.]exe[.]zip

General

Target

18efe1ff6e54ee6f595a6271088b62623a7d0a5eca274fc5b31e082161d29671.exe.zip
Size

3.2MB
MD5

20fc19df6fb4cddd8edbef478c881e7d
SHA1

4a4de051bcad25c6d4a9a29ea38405461f5359c8
SHA256

b00fae3d5411bf91215641a96caa65a8a952208f98cdeb450656202bad20866e
SHA512

b44d6faaae766970c7a1bcffedf5939642ebc11766caa0471a1623689a5cb3fbaf0bec3721bcf5ddbb8824434c2806e00811a3ae2e33d8497ef74a6e98652e5b
SSDEEP

49152:2wzroWJ9kYPuSbjre3EzbErUZ1vrgMioXry+Y9r2EDd1VNHe9MxpiVJjmmzgY54Q:H1J6YP3mEHeC1Aoba9CmDN+GuVJy854Q

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/18efe1ff6e54ee6f595a6271088b62623a7d0a5eca274fc5b31e082161d29671.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/18efe1ff6e54ee6f595a6271088b62623a7d0a5eca274fc5b31e082161d29671.exe

18efe1ff6e54ee6f595a6271088b62623a7d0a5eca274fc5b31e082161d29671.exe.zip
.zip

Password: infected
18efe1ff6e54ee6f595a6271088b62623a7d0a5eca274fc5b31e082161d29671.exe
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 11.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE