320bb1efa1263c636702188cd97f68699aebbb88c2c2c92bf97a68e689fa6f89

Sharing

Copy URL

Twitter E-mail

General

Target

320bb1efa1263c636702188cd97f68699aebbb88c2c2c92bf97a68e689fa6f89
Size

1.4MB
MD5

18202e554a88e92434931ac3b1891054
SHA1

80994eb64ee39ae7db97229d52f11c5ba405cf74
SHA256

320bb1efa1263c636702188cd97f68699aebbb88c2c2c92bf97a68e689fa6f89
SHA512

dd136585a5e7e9703c55b8a5e896b3031cec0f4128a961a0210f8a7f4d8ffc4e0cf39e6834b6999903f0068b12e20766bf0488296eb1c0cd0a90f9fe3e9600af
SSDEEP

24576:ZsHBDkSi/OlPL+JpPME1Fa07ZroSfWDny5VcfCR9ADVXTFtCm9m3ojk1v3SJVo9U:ZsHBDkSi/OJL+bPMEzagZroQWDnAoPFP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

resource	yara_rule
sample	upx

Files

320bb1efa1263c636702188cd97f68699aebbb88c2c2c92bf97a68e689fa6f89
.exe windows x86

Code Sign

48:31:2e:24:f2:27:26:86:49:94:7f:aa:49:23:e0:7a
Certificate

Issuer

CN=NetSarang Computer\, Inc

Not Before

16-04-2018 19:48

Not After

16-04-2019 20:08

Subject

CN=NetSarang Computer\, Inc

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7a:a3:d0:d9:8c:14:36:1b:95:b1:e7:7a:0d:69:88:be:4a:8a:72:cf
Signer

Actual PE Digest

7a:a3:d0:d9:8c:14:36:1b:95:b1:e7:7a:0d:69:88:be:4a:8a:72:cf

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=NetSarang Computer\, Inc

16-04-2018 19:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

48:31:2e:24:f2:27:26:86:49:94:7f:aa:49:23:e0:7aCertificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7a:a3:d0:d9:8c:14:36:1b:95:b1:e7:7a:0d:69:88:be:4a:8a:72:cfSigner

Signature Validations

Verification

16-04-2018 19:59 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 148KB

UPX1 Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 3KB - Virtual size: 4KB

48:31:2e:24:f2:27:26:86:49:94:7f:aa:49:23:e0:7a
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7a:a3:d0:d9:8c:14:36:1b:95:b1:e7:7a:0d:69:88:be:4a:8a:72:cf
Signer

16-04-2018 19:59
Valid: false

UPX0
Size: - Virtual size: 148KB

UPX1
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 3KB - Virtual size: 4KB