320ecbcf165e59f3aa79faf7b80d076e979c2cee166d6fcd225e4be5cac2bce1[.]zip

General

Target

320ecbcf165e59f3aa79faf7b80d076e979c2cee166d6fcd225e4be5cac2bce1.zip
Size

634KB
MD5

74393a7e6fb319de8e7d93c2603b7779
SHA1

18ef81781ff53266386e6e7468f7f3fa250bd127
SHA256

21c7ebcb595e96358fbc73b8ca35cd12c468da108a2ff7f8d0324415dff620cb
SHA512

58f4ebada6630f72be928a1cfde63f6f44e1c7786707163a559b9e88d32e7295d10ff66be8443bd8e69b771d5800b5cf01459c262e4e68308085df540b8093a1
SSDEEP

12288:Dsb8hWmI2PO/2cQ3wsQnnNxFbwcmCsPmoDuwMtBX/3sNrXMmT+u+Xt/hE4:o4Mrh5QALxFbwvCsPpRyp/G4mNCt/C4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/ORY987650090.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack003/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/ORY987650090.exe
unpack003/out.upx

Files

320ecbcf165e59f3aa79faf7b80d076e979c2cee166d6fcd225e4be5cac2bce1.zip
.zip

Password: infected
320ecbcf165e59f3aa79faf7b80d076e979c2cee166d6fcd225e4be5cac2bce1.zip
.zip

Password: infected
ORY987650090.exe
.exe windows:5 windows x86 arch:x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 956KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 370KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 415KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 619KB - Virtual size: 618KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 422KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 956KB

UPX1 Size: 370KB - Virtual size: 372KB

.rsrc Size: 415KB - Virtual size: 416KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 619KB - Virtual size: 618KB

.rdata Size: 191KB - Virtual size: 190KB

.data Size: 18KB - Virtual size: 28KB

.rsrc Size: 422KB - Virtual size: 422KB

.reloc Size: 29KB - Virtual size: 29KB

UPX0
Size: - Virtual size: 956KB

UPX1
Size: 370KB - Virtual size: 372KB

.rsrc
Size: 415KB - Virtual size: 416KB

.text
Size: 619KB - Virtual size: 618KB

.rdata
Size: 191KB - Virtual size: 190KB

.data
Size: 18KB - Virtual size: 28KB

.rsrc
Size: 422KB - Virtual size: 422KB

.reloc
Size: 29KB - Virtual size: 29KB