39ccb337ea4f7d4f9ac8f288112149c752397241d57a210cbd1a915520df8eba

Sharing

Copy URL

Twitter E-mail

General

Target

39ccb337ea4f7d4f9ac8f288112149c752397241d57a210cbd1a915520df8eba
Size

704KB
MD5

720a2feeebc656d89028e4c421591b5a
SHA1

8d9c389ebc7a63045b1b096b237edaca6052a32d
SHA256

39ccb337ea4f7d4f9ac8f288112149c752397241d57a210cbd1a915520df8eba
SHA512

09151eb70c0111ac3b3b5c14eb6150945ca0b51e855d3c562a95f2841ff1989459fab555357f6e9807f2a0c0cb17c3d53c022a762ffcdf7c52597d6fc0af93d1
SSDEEP

12288:vQxMf/2uESg7HSEv+J1jzEbJA4MGyKrydy2meU9UIrFUl7p2Bbra3E8rr2vR:vQxMGuESg7yEvq1jzMM/42mh9nA4a3EB

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

39ccb337ea4f7d4f9ac8f288112149c752397241d57a210cbd1a915520df8eba
.exe windows x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:b6:17:b2:3d:52:29:10:7b:7f:97:c4:a7:cc:25:6c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/04/2012, 00:00

Not After

05/04/2013, 23:59

Subject

CN=深圳市窝窝游科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Provided by TrustAsia,O=深圳市窝窝游科技有限公司,L=深圳,ST=广东,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:ac:8b:c4:59:e7:6b:11:fb:e5:9f:e6:5f:b7:7e:40:3b:b0:18:46
Signer

Actual PE Digest

61:ac:8b:c4:59:e7:6b:11:fb:e5:9f:e6:5f:b7:7e:40:3b:b0:18:46

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=深圳市窝窝游科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Provided by TrustAsia,O=深圳市窝窝游科技有限公司,L=深圳,ST=广东,C=CN

03/05/2012, 01:56
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 674KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

20:b6:17:b2:3d:52:29:10:7b:7f:97:c4:a7:cc:25:6cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

61:ac:8b:c4:59:e7:6b:11:fb:e5:9f:e6:5f:b7:7e:40:3b:b0:18:46Signer

Signature Validations

Verification

03/05/2012, 01:56 Valid: false

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.2MB

UPX1 Size: 674KB - Virtual size: 676KB

.rsrc Size: 14KB - Virtual size: 16KB

Headers

File Characteristics

Sections

.text Size: 236KB - Virtual size: 232KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

20:b6:17:b2:3d:52:29:10:7b:7f:97:c4:a7:cc:25:6c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

61:ac:8b:c4:59:e7:6b:11:fb:e5:9f:e6:5f:b7:7e:40:3b:b0:18:46
Signer

03/05/2012, 01:56
Valid: false

UPX0
Size: - Virtual size: 3.2MB

UPX1
Size: 674KB - Virtual size: 676KB

.rsrc
Size: 14KB - Virtual size: 16KB

.text
Size: 236KB - Virtual size: 232KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB