7a42e1392facd9e82f0d2d9d13e63d3d[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7a42e1392facd9e82f0d2d9d13e63d3d.zip
Size

34KB
MD5

6166601cc6b6bf536d59de9f9ee11889
SHA1

ccac2892f22a47f235877b16dd72f877dc651f65
SHA256

76233c776117ca4fec8a19a7b5ad646ced08b44c9928d81d429298259cbae4d1
SHA512

e05ec013ec468fbc2638cacfd0b685c66b6b5a8f7a50fe4622a52cbe9b7815f38b0aa91acd4eba59022cdf8d0015f2d6066370bdbff89f242608a5b3c146b080
SSDEEP

768:JBA0/h37mtFGVtGza/wb9cgfJ9nccuPd8UPcr9qn1n+5:JtNStFigzaECgfJ9ncxPdtUo1+5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/ce70ef4db2b6e1693a7e4739eb41088c69752f699742dd10b9ce506feeb93383	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ce70ef4db2b6e1693a7e4739eb41088c69752f699742dd10b9ce506feeb93383

Files

7a42e1392facd9e82f0d2d9d13e63d3d.zip
.zip

Password: infected
ce70ef4db2b6e1693a7e4739eb41088c69752f699742dd10b9ce506feeb93383
.exe windows:5 windows x86 arch:x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: 51KB - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE