c92ba16649ee131b682394e971f5ecf325577305470b0b9640951474e9de674f[.]exe[.]zip

General

Target

c92ba16649ee131b682394e971f5ecf325577305470b0b9640951474e9de674f.exe.zip
Size

3.5MB
MD5

463424d300dfdd33af0a5d425d9137b0
SHA1

744fbacd88f122754b3758f1ed5b32326178b375
SHA256

3c557d7eb318a24f7e11339b44fa7ec1bda2f221a0451ae64f25d6e4aace546b
SHA512

53b947f07d798f0e348d57bc1707a30fd86298bd80bae981d898f710e5829be213d5332ad707125614428e8deb01d7a483a954240b0c2cdd1abd831504ca678f
SSDEEP

98304:LbvSkJFIeUTwEMLoF4o09VaUSvDPnZK7B:va8kn9GhazvSB

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/c92ba16649ee131b682394e971f5ecf325577305470b0b9640951474e9de674f.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c92ba16649ee131b682394e971f5ecf325577305470b0b9640951474e9de674f.exe

c92ba16649ee131b682394e971f5ecf325577305470b0b9640951474e9de674f.exe.zip
.zip

Password: infected
c92ba16649ee131b682394e971f5ecf325577305470b0b9640951474e9de674f.exe
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE