f7ebbf8c2c736c38e7cfd724b245e138601ce38acbab28b00bc200c3ecd924fd

Sharing

Copy URL Twitter E-mail

General

Target

f7ebbf8c2c736c38e7cfd724b245e138601ce38acbab28b00bc200c3ecd924fd
Size

1017KB
MD5

ee9efac2b5e38701dfdb22a819348c25
SHA1

20fb43ad3520d3329e847db12fe6622e3086c3e3
SHA256

f7ebbf8c2c736c38e7cfd724b245e138601ce38acbab28b00bc200c3ecd924fd
SHA512

48136a46b061d684523a66931ca4aed2322c55ba1124eba9c47074498e96a4d99713c2aa3186545b227da30aefdb567ac183df3d9ce9f379c03f638752a9cd1e
SSDEEP

24576:TPNoN/emGEFNiFxU/50kZtScZtSq23vg+ecM9N8D:Tlo93TiU/508S0Sn3o+XMwD

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

f7ebbf8c2c736c38e7cfd724b245e138601ce38acbab28b00bc200c3ecd924fd
.exe windows x86

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:72:ec:1f:c1:99:39:b7:ce:9f:da:7a:02:59:26:23:f3
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

07/08/2014, 02:40

Not After

07/10/2015, 08:53

Subject

CN=SoftTower,OU=Dev Team,O=SoftTower,L=Jeonju-si,ST=Jeollabuk-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:00

Not After

23/05/2016, 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:80:2b:2d:60:d4:98:c5:36:34:b8:34:d8:3b:32:75:3c:b0:a1:83
Signer

Actual PE Digest

8c:80:2b:2d:60:d4:98:c5:36:34:b8:34:d8:3b:32:75:3c:b0:a1:83

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=SoftTower,OU=Dev Team,O=SoftTower,L=Jeonju-si,ST=Jeollabuk-do,C=KR

20/10/2014, 04:42
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 59KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

11:21:72:ec:1f:c1:99:39:b7:ce:9f:da:7a:02:59:26:23:f3Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

8c:80:2b:2d:60:d4:98:c5:36:34:b8:34:d8:3b:32:75:3c:b0:a1:83Signer

Signature Validations

Verification

20/10/2014, 04:42 Valid: false

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 104KB

UPX1 Size: 59KB - Virtual size: 60KB

.rsrc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 96KB - Virtual size: 94KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 12KB - Virtual size: 29KB

.rsrc Size: 8KB - Virtual size: 5KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

11:21:72:ec:1f:c1:99:39:b7:ce:9f:da:7a:02:59:26:23:f3
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

8c:80:2b:2d:60:d4:98:c5:36:34:b8:34:d8:3b:32:75:3c:b0:a1:83
Signer

20/10/2014, 04:42
Valid: false

UPX0
Size: - Virtual size: 104KB

UPX1
Size: 59KB - Virtual size: 60KB

.rsrc
Size: 4KB - Virtual size: 4KB

.text
Size: 96KB - Virtual size: 94KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 12KB - Virtual size: 29KB

.rsrc
Size: 8KB - Virtual size: 5KB