c87e37d1a9a9ad1199a2e395f416f3147930fdb9e225abad9da8ce6bbcbad826

Sharing

Copy URL Twitter E-mail

General

Target

c87e37d1a9a9ad1199a2e395f416f3147930fdb9e225abad9da8ce6bbcbad826
Size

512KB
MD5

8035e3b843f98dc50997eb6cfc899bff
SHA1

c6b2abf7c3b213230fe6be47a57a52bfb8ba55be
SHA256

c87e37d1a9a9ad1199a2e395f416f3147930fdb9e225abad9da8ce6bbcbad826
SHA512

db7a2c17e6da7fb3314723b4b81e720fcee555400a28077ca4be2c445d454b1eea9c4ee3ba3d1586abc4139eea3f783d26b36d739003b078e0f977ac81653ec2
SSDEEP

12288:mu6aHcMddkEQ7gnxQqXG2z5KRzz6G2V7OZl:rHdkcnxRBEzubMl

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

c87e37d1a9a9ad1199a2e395f416f3147930fdb9e225abad9da8ce6bbcbad826
.exe windows x86

Code Sign

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

29/01/2016, 09:18

Not After

29/03/2017, 09:18

Subject

CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

Issuer

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5:7e:79:68:96
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

81:ac:88:3c:47:d9:b2:73:5b:eb:0d:6f:30:21:12:13:9c:c0:07:7b
Signer

Actual PE Digest

81:ac:88:3c:47:d9:b2:73:5b:eb:0d:6f:30:21:12:13:9c:c0:07:7b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

18/02/2017, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ecode
Size: 478KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.beyond
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4bCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6Certificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5Certificate

Key Usages

1e:b1:32:d5:7e:79:68:96Certificate

Extended Key Usages

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

01Certificate

Key Usages

81:ac:88:3c:47:d9:b2:73:5b:eb:0d:6f:30:21:12:13:9c:c0:07:7bSigner

Signature Validations

Verification

18/02/2017, 00:00 Valid: false

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.ecode Size: 478KB - Virtual size: 2.7MB

.rsrc Size: 512B - Virtual size: 20KB

.beyond Size: 20KB - Virtual size: 20KB

.adata Size: - Virtual size: 4KB

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b
Certificate

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

1e:b1:32:d5
Certificate

1e:b1:32:d5:7e:79:68:96
Certificate

19:c2:85:30:e9:3b:36
Certificate

01
Certificate

81:ac:88:3c:47:d9:b2:73:5b:eb:0d:6f:30:21:12:13:9c:c0:07:7b
Signer

18/02/2017, 00:00
Valid: false

.text
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.ecode
Size: 478KB - Virtual size: 2.7MB

.rsrc
Size: 512B - Virtual size: 20KB

.beyond
Size: 20KB - Virtual size: 20KB

.adata
Size: - Virtual size: 4KB