ed44c98c40576ef50f6abcf6e40c71d7[.]bin

General

Target

ed44c98c40576ef50f6abcf6e40c71d7.bin
Size

2.8MB
MD5

623a75d74e62d8cb15c05301f6f6b06a
SHA1

fde94ed9211d07db5c5a7103414c2fde17406a61
SHA256

01fe6afddde790315aa9606e798c597b395041e61413edeab5edd6399e5224a7
SHA512

b947a0f8be524376c020eb6cd9b30393ff03f3262bfdd07c0a0a360704bdd5b3530160324314fece9a44d62f459d5662d4cbb84fd720604a919f2692599ce5be
SSDEEP

49152:ZTL6axW3bPN++AlMInXWkoNxqiSJ5P0L2Ym5UXqpZKOsrlEQw/97rXOIifS:w8Wjk+8GlCiSJ5sL2gXqpZlsxEJ9WI/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe
unpack002/out.upx

Files

ed44c98c40576ef50f6abcf6e40c71d7.bin
.zip

Password: infected
05d385e9faa8175db3c963f7fad2b3ecee0bb45deacfbf8824bdea9a181e63b1.exe
.exe windows:6 windows x86 arch:x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 5.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 214KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 5.0MB

UPX1 Size: 2.9MB - Virtual size: 2.9MB

UPX2 Size: 512B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 4.5MB - Virtual size: 4.5MB

.data Size: 214KB - Virtual size: 436KB

.idata Size: 1024B - Virtual size: 988B

.reloc Size: 120KB - Virtual size: 120KB

.symtab Size: 512B - Virtual size: 4B

UPX0
Size: - Virtual size: 5.0MB

UPX1
Size: 2.9MB - Virtual size: 2.9MB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 4.5MB - Virtual size: 4.5MB

.data
Size: 214KB - Virtual size: 436KB

.idata
Size: 1024B - Virtual size: 988B

.reloc
Size: 120KB - Virtual size: 120KB

.symtab
Size: 512B - Virtual size: 4B