699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.zip
- SHA256 d615ed7590714a88e818ff6cc2c1c6681472776116d5075f4aa3d6f053256b25
Password
infected
General
- Target 699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.zip
- Size 145KB
- Sample251102-xpc12scy5h
- SHA256 d615ed7590714a88e818ff6cc2c1c6681472776116d5075f4aa3d6f053256b25
- MD5 48229dbff14bbf423a5f9518c4118e92
- SHA1 498086d5ce4103bd2a8cde781370827d4f168717
- SHA512 aa7563eb95de8398f767274a1dedcd792e9b14c9ab2930538fb28479e2267314d10002f4679ebee6abcbb11bacf60523b8125c6a211259a16ec1f46943713a53
- SSDEEP 3072:UW6cAhDuN3Ck6uk2q/ZzbIy1tHi52CdAf0urpzEmgs5TMqCluA1Cn:UWSA1CfuvqlsyS5TAsurlEmgWhCgAwn
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.exe unpack002/out.upx
File Explorer
-
699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.zip.zip 145KB
-
699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.exe.exe 156KB
-
out.upx.exe 397KB
699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd.exe
- SHA256 699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd
- MD5 14ee62fcc9163509856671400429ad55
- SHA1 7544332b52769ca853d900669ef5e272a2ae1665
- SHA512 4d71c87be6f6ad7c9f3277b60850cd7136cecfd5f15621d1e56b1897008da8cc742578112ea955f8417c8d4cf13bcfb92e7ceafb34720017b47d81c4d2603bff
- SSDEEP 3072:bD7p4cx5vL2RyigBpUfoatwV6amXjc725K40A6v:bDnx1s/fo5mA212
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
17262064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
16.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
154KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=10, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=22, id=259, version=24237,
count=29, id=261, version=24237,
count=20, id=260, version=24237,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=143, id=1, productName=Unmarked objects,
count=193, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=7, id=264, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
out.upx
- SHA256 95379b30f0df4d19319c2ed76031b7ab157acd542eab3e8cc94442707c93a3f5
- MD5 fe1fdc257dab082ad6e759603fa80edf
- SHA1 792267a4b42b06a482971a1570523ede86b3f3a9
- SHA512 cf9ccc6a65a284a368b359b2381efe69ccf35622ffc31ffffd785c9ee43d719c2cf68d80331391cc2b33ebbe49b7a2a087e66c69019dddc67cd4483bf42c65f4
- SSDEEP 6144:6DE250xM+M9h2j2CxD/wVkmJU/dODz2V0Pz2V0Pz2V0Pz2V01n:J2wM+Maj2CxMV6/oDnnn9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
70389
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
47KB
Virtual Size
16.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=22, id=259, version=24237,
count=29, id=261, version=24237,
count=20, id=260, version=24237,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=143, id=1, productName=Unmarked objects,
count=193, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=7, id=264, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,