2d1fa81b87d5a59e24f01ab0d6ebae894bf996e9b119313fed0d476983cee1b8

Sharing

Copy URL Twitter E-mail

General

Target

2d1fa81b87d5a59e24f01ab0d6ebae894bf996e9b119313fed0d476983cee1b8
Size

1.3MB
MD5

a35021573306cfdf997511faf3f76ab0
SHA1

20bf69e8a5ee4959124f1321770fb088e0fd291c
SHA256

2d1fa81b87d5a59e24f01ab0d6ebae894bf996e9b119313fed0d476983cee1b8
SHA512

9ebcc5beb097407bf32b2cb2b72f1c6737f8bd2a65fb36174804d2fc9df9db1cd1f5618ba80cbf03df5c54705d1e2fc8c78d08e924473c08029ed57b688e0ac1
SSDEEP

24576:NRNrXy19ZzDqDrZcBhPkA8DrtOB77KPpUwwrJwgptAW:nY17nqR3AlB3KPpvwr

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

2d1fa81b87d5a59e24f01ab0d6ebae894bf996e9b119313fed0d476983cee1b8
.dll windows x86

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:96:2d:85:25:a8:30:28:b6:f2:c9:b6:ca:31:c3:ca:2c
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

16/12/2014, 12:18

Not After

17/12/2015, 12:18

Subject

CN=Alpha IS (Fried Cookie Ltd.),O=Alpha IS (Fried Cookie Ltd.),L=Tel Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

60:ea:f2:3c:00:c9:7f:02:d0:5e:98:c7:dc:c7:41:4c:8b:1d:32:83
Signer

Actual PE Digest

60:ea:f2:3c:00:c9:7f:02:d0:5e:98:c7:dc:c7:41:4c:8b:1d:32:83

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Alpha IS (Fried Cookie Ltd.),O=Alpha IS (Fried Cookie Ltd.),L=Tel Aviv,C=IL

28/10/2022, 15:07
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CPlApplet

Sections

UPX0
Size: - Virtual size: 248KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 74B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:96:2d:85:25:a8:30:28:b6:f2:c9:b6:ca:31:c3:ca:2cCertificate

Extended Key Usages

Key Usages

60:ea:f2:3c:00:c9:7f:02:d0:5e:98:c7:dc:c7:41:4c:8b:1d:32:83Signer

Signature Validations

Verification

28/10/2022, 15:07 Valid: false

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 248KB

UPX1 Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 99KB - Virtual size: 99KB

DATA Size: 1.4MB - Virtual size: 1.4MB

BSS Size: - Virtual size: 3KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 74B

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 5KB - Virtual size: 5KB

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:96:2d:85:25:a8:30:28:b6:f2:c9:b6:ca:31:c3:ca:2c
Certificate

60:ea:f2:3c:00:c9:7f:02:d0:5e:98:c7:dc:c7:41:4c:8b:1d:32:83
Signer

28/10/2022, 15:07
Valid: false

UPX0
Size: - Virtual size: 248KB

UPX1
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 99KB - Virtual size: 99KB

DATA
Size: 1.4MB - Virtual size: 1.4MB

BSS
Size: - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 74B

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 5KB - Virtual size: 5KB