7c8157d3e747e56417c7d816cfd92a42446512687ee3a6c65682898ae308df4c

Sharing

Copy URL Twitter E-mail

General

Target

7c8157d3e747e56417c7d816cfd92a42446512687ee3a6c65682898ae308df4c
Size

707KB
MD5

d4d15ef44f8d8796cc73fc1ee34b53cd
SHA1

e0a4e39d45c31e2b1947f951938b9533932008be
SHA256

7c8157d3e747e56417c7d816cfd92a42446512687ee3a6c65682898ae308df4c
SHA512

2931d9f83cc1a32cfecdb7e9bd93c7423b4f54558856ec57f5475a3ec2eb5d122ef2d75d887dc6eb44a564b39103727765da446666611b3f025dc93c69708e90
SSDEEP

12288:XOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPigsW5yo+i4Hj:Xq5TfcdHj4fmbzsWx4H

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/out.upx	autoit_exe

Files

7c8157d3e747e56417c7d816cfd92a42446512687ee3a6c65682898ae308df4c
.exe windows x86

Code Sign

64:cd:ee:9f:f4:44:ce:6c:73:9d:53:16:11:5b:53:75
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

11/04/2017, 07:29

Not After

11/05/2019, 07:29

Subject

CN=厦门仁优网络科技有限公司,O=厦门仁优网络科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

1f:ce:a7:f6:a9:7f:e9
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:c2:83:3c:a6:d3:85:70:f9:3c:57:58:ba:c0:cd:ca
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

11/04/2017, 07:40

Not After

11/05/2019, 07:40

Subject

CN=厦门仁优网络科技有限公司,O=厦门仁优网络科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

1f:ce:a7:f6:a9:7f:e9
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:34:84:a8:8c:2a:f0:8f:31:8d:8b:06:25:12:7a:e3:6e:00:9a:19:02:30:17:1c:0e:58:5b:bc:83:0e:7d:ba
Signer

Actual PE Digest

0d:34:84:a8:8c:2a:f0:8f:31:8d:8b:06:25:12:7a:e3:6e:00:9a:19:02:30:17:1c:0e:58:5b:bc:83:0e:7d:ba

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=厦门仁优网络科技有限公司,O=厦门仁优网络科技有限公司,L=厦门市,ST=福建省,C=CN

17/11/2022, 13:20
Valid: false

58:a4:4c:5e:6c:47:87:ff:96:bd:25:af:cb:70:2c:2c:be:00:bf:07
Signer

Actual PE Digest

58:a4:4c:5e:6c:47:87:ff:96:bd:25:af:cb:70:2c:2c:be:00:bf:07

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=厦门仁优网络科技有限公司,O=厦门仁优网络科技有限公司,L=厦门市,ST=福建省,C=CN

17/11/2022, 13:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 884KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 334KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 365KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

64:cd:ee:9f:f4:44:ce:6c:73:9d:53:16:11:5b:53:75Certificate

Extended Key Usages

Key Usages

1f:ce:a7:f6:a9:7f:e9Certificate

Key Usages

2a:c2:83:3c:a6:d3:85:70:f9:3c:57:58:ba:c0:cd:caCertificate

Extended Key Usages

Key Usages

1f:ce:a7:f6:a9:7f:e9Certificate

Key Usages

0d:34:84:a8:8c:2a:f0:8f:31:8d:8b:06:25:12:7a:e3:6e:00:9a:19:02:30:17:1c:0e:58:5b:bc:83:0e:7d:baSigner

Signature Validations

Verification

17/11/2022, 13:20 Valid: false

58:a4:4c:5e:6c:47:87:ff:96:bd:25:af:cb:70:2c:2c:be:00:bf:07Signer

Signature Validations

Verification

17/11/2022, 13:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 884KB

UPX1 Size: 334KB - Virtual size: 336KB

.rsrc Size: 365KB - Virtual size: 368KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 557KB - Virtual size: 557KB

.rdata Size: 179KB - Virtual size: 179KB

.data Size: 24KB - Virtual size: 39KB

.rsrc Size: 364KB - Virtual size: 364KB

.reloc Size: 41KB - Virtual size: 41KB

64:cd:ee:9f:f4:44:ce:6c:73:9d:53:16:11:5b:53:75
Certificate

1f:ce:a7:f6:a9:7f:e9
Certificate

2a:c2:83:3c:a6:d3:85:70:f9:3c:57:58:ba:c0:cd:ca
Certificate

1f:ce:a7:f6:a9:7f:e9
Certificate

0d:34:84:a8:8c:2a:f0:8f:31:8d:8b:06:25:12:7a:e3:6e:00:9a:19:02:30:17:1c:0e:58:5b:bc:83:0e:7d:ba
Signer

17/11/2022, 13:20
Valid: false

58:a4:4c:5e:6c:47:87:ff:96:bd:25:af:cb:70:2c:2c:be:00:bf:07
Signer

17/11/2022, 13:20
Valid: false

UPX0
Size: - Virtual size: 884KB

UPX1
Size: 334KB - Virtual size: 336KB

.rsrc
Size: 365KB - Virtual size: 368KB

.text
Size: 557KB - Virtual size: 557KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 24KB - Virtual size: 39KB

.rsrc
Size: 364KB - Virtual size: 364KB

.reloc
Size: 41KB - Virtual size: 41KB