gmer[.]zip | Triage

Sharing

General

Target

gmer.zip
Size

362KB
MD5

fc98d351ca1a64897503036e665e14c6
SHA1

3fb1ea6eadf5551e5b81c22b0a45ce892c5a87b2
SHA256

de3abde117d7eacbb638bc7d0151f929cf80a4bb5e5beb1e390839e96fc6722a
SHA512

ace21b7ca04162a85b46f5727e369ca5de36a99aa9870971bbe2e794dd9b7083834a2c9954c33c0199740fb78ab8f32b3052a9b9e72419add30664caaa1d689d
SSDEEP

6144:uBzWZvuPzYt+4gpqK6w+cdLMXzl3udtSToGLjwaurCDG2h46ArZLtQ2AA:Wz4k2+nzANXz5u3HX6AdLAA

Score

7^/10

Malware Config

Signatures

UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

static1/unpack001/gmer.exe upx
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/gmer.exe
unpack002/out.upx

Files

gmer.zip
.zip
gmer.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 508KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 366KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ