cf8936ef96b22d34168b1e6b195bdc3276fb2c9fcb54800a8e2b76524f6931de | Triage

Sharing

General

Target

cf8936ef96b22d34168b1e6b195bdc3276fb2c9fcb54800a8e2b76524f6931de
Size

80KB
MD5

293962c3ff3b4abdd08bfb2f9c848973
SHA1

59275f2e4d60b09acdea7359e9d2d1903b056b2a
SHA256

cf8936ef96b22d34168b1e6b195bdc3276fb2c9fcb54800a8e2b76524f6931de
SHA512

e4c5a0ba9b2445fd0f15d6aead28bce474f1cfdd3ff773c53a55377ee7e94963d0b59539ada23e859e1ee8724aae01d2d1154b87de06de2dbf6def2e140504e8
SSDEEP

1536:L0R7esguDHsi7pyMLCKa3/poarlXJySXm5Zz2f1/gHqnouy8Ec+sL:4R6sgysipy02aaIbzCUyouth+

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

Files

cf8936ef96b22d34168b1e6b195bdc3276fb2c9fcb54800a8e2b76524f6931de
.exe windows x86

Code Sign

fc:59:4b:2e:2c:30:e2:b4:1f:4c:a2:4b:35:0b:ca:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01-10-2009 00:00

Not After

01-10-2010 23:59

Subject

CN=Bitsum Technologies,O=Bitsum Technologies,POSTALCODE=37877,STREET=1605 Allen Rd.,L=Talbott,ST=TN,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bc:e2:de:9b:22:8a:9a:39:76:46:d4:70:2d:de:e8:32:df:65:1e:b5
Signer

Actual PE Digest

bc:e2:de:9b:22:8a:9a:39:76:46:d4:70:2d:de:e8:32:df:65:1e:b5

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Bitsum Technologies,O=Bitsum Technologies,POSTALCODE=37877,STREET=1605 Allen Rd.,L=Talbott,ST=TN,C=US

24-11-2022 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 160KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 63KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE