e830d4795e7a03e10bb55a96cfc8085a[.]zip | Triage

Sharing

General

Target

e830d4795e7a03e10bb55a96cfc8085a.zip
Size

94KB
MD5

5088fdca9eeb0693ee627658f3debd25
SHA1

53b40965861b395495baa58e4c0d59d7b53cef97
SHA256

ceed12c6721d07619be278eafc7fa4c35d4c647694d7db08fd7803f785bd8fb7
SHA512

7d1d4fff36aba9a3be79478316d418e5729668421953be9e3598bc2870833f5eb2384760c429e1ce256443197f948645d5442f5c0a3d72407d9bbe670f539ac3
SSDEEP

1536:Tl9GCfn83bNhXcsxWiUq1ymmRU5dxikr4NHeBXRowY1moegRC7XISOkjug1SyP1b:TLVE3jc4Uq1ym949eBXRMm5gk7XISrSy

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/3c0e62668297340d7c921f31ff8b93aef4045fd8451e2ed1af51487b4b840a0b	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c0e62668297340d7c921f31ff8b93aef4045fd8451e2ed1af51487b4b840a0b
unpack002/out.upx

Files

e830d4795e7a03e10bb55a96cfc8085a.zip
.zip

Password: infected
3c0e62668297340d7c921f31ff8b93aef4045fd8451e2ed1af51487b4b840a0b
.exe windows:4 windows x86 arch:x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.code
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ