818c25dead553315d6a57090b13cc151a56a257cbf38009ec331a8f8a6b96474

Sharing

Copy URL

Twitter E-mail

General

Target

818c25dead553315d6a57090b13cc151a56a257cbf38009ec331a8f8a6b96474
Size

1.5MB
MD5

6526fce1e0dae913d23d5d3cdfe490bb
SHA1

61735bdc0cacf7ae63d7476a1d9884b0520cbea2
SHA256

818c25dead553315d6a57090b13cc151a56a257cbf38009ec331a8f8a6b96474
SHA512

a28a1a9830f0e4d7d3306dc5ed8693c8984e7c04e02760dc4ad9edcf1f22e42bcb8b5f1c09571a920fb99fb6f9d1a2c1c48a76a404bb6db8ca069cc7770a9144
SSDEEP

24576:Vx8RRrFbKWdSScnVesdIDCdrG5y7pMOoj8cUnDdr6Py4qfS:VyRhdSoswC8ARojCV/S

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

818c25dead553315d6a57090b13cc151a56a257cbf38009ec331a8f8a6b96474
.exe windows x86

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-04-2007 00:00

Not After

09-07-2019 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:01:b2:e5:0e:fd:4c:77:bf:cc:40:10:8b:0e:3c:ff
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01-02-2008 00:00

Not After

31-01-2013 23:59

Subject

CN=上海格尔软件股份有限公司,O=上海格尔软件股份有限公司,POSTALCODE=200042,STREET=www.koal.com,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

1f:39:f6:37:d6:6d:a8:b7:5b:d7:a9:3e:d8:6f:7a:48:19:a0:93:2d
Signer

Actual PE Digest

1f:39:f6:37:d6:6d:a8:b7:5b:d7:a9:3e:d8:6f:7a:48:19:a0:93:2d

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=上海格尔软件股份有限公司,O=上海格尔软件股份有限公司,POSTALCODE=200042,STREET=www.koal.com,L=上海,ST=上海,C=CN

13-06-2012 09:16
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 95KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

3f:01:b2:e5:0e:fd:4c:77:bf:cc:40:10:8b:0e:3c:ffCertificate

Extended Key Usages

Key Usages

1f:39:f6:37:d6:6d:a8:b7:5b:d7:a9:3e:d8:6f:7a:48:19:a0:93:2dSigner

Signature Validations

Verification

13-06-2012 09:16 Valid: false

Headers

File Characteristics

Sections

.text Size: 95KB - Virtual size: 200KB

.rdata Size: 12KB - Virtual size: 48KB

.data Size: 4KB - Virtual size: 32KB

.rsrc Size: 5KB - Virtual size: 12KB

.aspack Size: 7KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

3f:01:b2:e5:0e:fd:4c:77:bf:cc:40:10:8b:0e:3c:ff
Certificate

1f:39:f6:37:d6:6d:a8:b7:5b:d7:a9:3e:d8:6f:7a:48:19:a0:93:2d
Signer

13-06-2012 09:16
Valid: false

.text
Size: 95KB - Virtual size: 200KB

.rdata
Size: 12KB - Virtual size: 48KB

.data
Size: 4KB - Virtual size: 32KB

.rsrc
Size: 5KB - Virtual size: 12KB

.aspack
Size: 7KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB