29fe6aa998480e266d668cdbb15c81af[.]bin

General

Target

29fe6aa998480e266d668cdbb15c81af.bin
Size

212KB
MD5

0198512f769bd877aee795a65797af77
SHA1

40f9c497bffccca0591b1505aeeb86a54fd0d40a
SHA256

b3fa82b02b88a9400b2fb11d3ac1e7e3e1c073bff9c8dbd5be2578c341f0a2fd
SHA512

214e0efb82d0725a207b51941a8bc3f09ab7ef31e5340d8485ae1ce39cf9e43071039700093726983d0e3fca3d89612c7f0daf81a552ab05d281b4de86c29a2f
SSDEEP

6144:vyrIWrxgjpnk34mqz7hIZ6hXeOFLWRuK+pgjEVF:Ebr+1k3mE6hXeGm+us

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/5972524960c4db1f5b4f50ddbfe450b20db03f01b4b5fd5f2a17c1d563513f43.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5972524960c4db1f5b4f50ddbfe450b20db03f01b4b5fd5f2a17c1d563513f43.exe
unpack002/out.upx

Files

29fe6aa998480e266d668cdbb15c81af.bin
.zip

Password: infected
5972524960c4db1f5b4f50ddbfe450b20db03f01b4b5fd5f2a17c1d563513f43.exe
.exe windows:4 windows x86 arch:x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 360KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 214KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 541KB - Virtual size: 541KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 384B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 360KB

UPX1 Size: 214KB - Virtual size: 216KB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 541KB - Virtual size: 541KB

.rdata Size: 1KB - Virtual size: 1KB

.eh_fram Size: 1024B - Virtual size: 828B

.bss Size: - Virtual size: 384B

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

UPX0
Size: - Virtual size: 360KB

UPX1
Size: 214KB - Virtual size: 216KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 541KB - Virtual size: 541KB

.rdata
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 1024B - Virtual size: 828B

.bss
Size: - Virtual size: 384B

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B