e6fb3ff2f366bff30e47cb9a1bddf9e93014b6745abce62a750a5d304d31d5ce

Sharing

Copy URL Twitter E-mail

General

Target

e6fb3ff2f366bff30e47cb9a1bddf9e93014b6745abce62a750a5d304d31d5ce
Size

34KB
MD5

55cf808a2a81712da802e57d8380bcaf
SHA1

3821afc7918fe5d6a13fdd8535f4a97e901e17a8
SHA256

e6fb3ff2f366bff30e47cb9a1bddf9e93014b6745abce62a750a5d304d31d5ce
SHA512

163ae1073eeee199c1ee94837ab4058e3abffd543c6cacf3d2137ff3b1c0bdf5f43a41bb70d89a0af137546d8bcfc135fd157d212ddec1cf7f3f8ae46a2b7b1f
SSDEEP

768:8RdT6ItXqG1/GypcPwyWwCv6l71UWLxAoejrKuxUwtPKdQrvk8:IdTPqG+tCv675LorKgr5Kuk8

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

e6fb3ff2f366bff30e47cb9a1bddf9e93014b6745abce62a750a5d304d31d5ce
.exe windows x86

Code Sign

50:ff:f0:c0:f0:0e:74:73:bd:68:f4:1b:97:1e:e7:47
Certificate

Issuer

CN=zhuxian,O=Mao,1.2.840.113549.1.9.1=#0c134d657465696f6340686f746d61696c2e636f6d

Not Before

08/08/2021, 03:18

Not After

31/12/2039, 23:59

Subject

CN=zhuxian,O=Mao,1.2.840.113549.1.9.1=#0c134d657465696f6340686f746d61696c2e636f6d

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

Issuer

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:7e:79:68:96
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:ec:98:4d:04:97:4d:e1:3e:86:70:4f:fa:c8:b5:7c:18:2a:8a:44
Signer

Actual PE Digest

d7:ec:98:4d:04:97:4d:e1:3e:86:70:4f:fa:c8:b5:7c:18:2a:8a:44

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=zhuxian,O=Mao,1.2.840.113549.1.9.1=#0c134d657465696f6340686f746d61696c2e636f6d

01/04/2011, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

50:ff:f0:c0:f0:0e:74:73:bd:68:f4:1b:97:1e:e7:47Certificate

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5:7e:79:68:96Certificate

Extended Key Usages

Key Usages

d7:ec:98:4d:04:97:4d:e1:3e:86:70:4f:fa:c8:b5:7c:18:2a:8a:44Signer

Signature Validations

Verification

01/04/2011, 00:00 Valid: false

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 52KB

UPX1 Size: 27KB - Virtual size: 28KB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 680B

50:ff:f0:c0:f0:0e:74:73:bd:68:f4:1b:97:1e:e7:47
Certificate

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

1e:b1:32:d5:7e:79:68:96
Certificate

d7:ec:98:4d:04:97:4d:e1:3e:86:70:4f:fa:c8:b5:7c:18:2a:8a:44
Signer

01/04/2011, 00:00
Valid: false

UPX0
Size: - Virtual size: 52KB

UPX1
Size: 27KB - Virtual size: 28KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 680B