9ed12afe6a2bff8d311492eb590b9d579c4e4b043061ea8938839e9ddc573119

Sharing

Copy URL Twitter E-mail

General

Target

9ed12afe6a2bff8d311492eb590b9d579c4e4b043061ea8938839e9ddc573119
Size

927KB
MD5

e061c904e2e51dc0c813d6e8c7b25221
SHA1

34c276c66c43a3be9e53747cdaff39a8b447c81e
SHA256

9ed12afe6a2bff8d311492eb590b9d579c4e4b043061ea8938839e9ddc573119
SHA512

973077789f134a198d762b0a2bd2f87028c37487cb632f3c98c3d1ccc5a62c9a1b17be804260ffcdf757c07c0e26a0629cb84e5ae0db872241289c218e167dd8
SSDEEP

24576:cbiDMrnfNMX7usQQ+PB18yB9kqOpC9VUpokYFh:LMrfN0jQQqSjQf

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

9ed12afe6a2bff8d311492eb590b9d579c4e4b043061ea8938839e9ddc573119
.exe windows x86

Code Sign

11:30
Certificate

Issuer

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

30/11/2014, 02:27

Not After

30/11/2016, 08:58

Subject

CN=Timofei Galkin,L=Protvino,ST=Moscow City,C=RU,1.2.840.113549.1.9.1=#0c0861407771632e6d65,2.5.4.13=#1310415467786365723859766a4d37546f42

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

24/10/2007, 22:01

Not After

24/10/2017, 22:01

Subject

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

d3:e1:b7:c6:f3:c8:40:5e:e1:b0:b3:c7:8a:22:0e:aa:36:7c:10:79
Signer

Actual PE Digest

d3:e1:b7:c6:f3:c8:40:5e:e1:b0:b3:c7:8a:22:0e:aa:36:7c:10:79

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Timofei Galkin,L=Protvino,ST=Moscow City,C=RU,1.2.840.113549.1.9.1=#0c0861407771632e6d65,2.5.4.13=#1310415467786365723859766a4d37546f42

05/12/2014, 15:23
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 910KB - Virtual size: 912KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 356KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 80B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

11:30Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

24Certificate

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

d3:e1:b7:c6:f3:c8:40:5e:e1:b0:b3:c7:8a:22:0e:aa:36:7c:10:79Signer

Signature Validations

Verification

05/12/2014, 15:23 Valid: false

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.8MB

UPX1 Size: 910KB - Virtual size: 912KB

.rsrc Size: 6KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.itext Size: 9KB - Virtual size: 8KB

.data Size: 49KB - Virtual size: 49KB

.bss Size: - Virtual size: 356KB

.idata Size: 16KB - Virtual size: 15KB

.didata Size: 3KB - Virtual size: 2KB

.tls Size: - Virtual size: 80B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 262KB - Virtual size: 262KB

.rsrc Size: 63KB - Virtual size: 63KB

11:30
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

24
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

01
Certificate

d3:e1:b7:c6:f3:c8:40:5e:e1:b0:b3:c7:8a:22:0e:aa:36:7c:10:79
Signer

05/12/2014, 15:23
Valid: false

UPX0
Size: - Virtual size: 2.8MB

UPX1
Size: 910KB - Virtual size: 912KB

.rsrc
Size: 6KB - Virtual size: 8KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.itext
Size: 9KB - Virtual size: 8KB

.data
Size: 49KB - Virtual size: 49KB

.bss
Size: - Virtual size: 356KB

.idata
Size: 16KB - Virtual size: 15KB

.didata
Size: 3KB - Virtual size: 2KB

.tls
Size: - Virtual size: 80B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 262KB - Virtual size: 262KB

.rsrc
Size: 63KB - Virtual size: 63KB