7f8df94d65bc34318b54811941b186c11da1524a0d7878e8203a11a72e3ecf4b

Sharing

Copy URL Twitter E-mail

General

Target

7f8df94d65bc34318b54811941b186c11da1524a0d7878e8203a11a72e3ecf4b
Size

151KB
MD5

8c1410c2da76d9786ae2917453e05b39
SHA1

a25814c2b79c5df73dac3e42142847e725c702f1
SHA256

7f8df94d65bc34318b54811941b186c11da1524a0d7878e8203a11a72e3ecf4b
SHA512

ee26e1ff0b3a298451b7057e797d7f638859d1792d84680ce021bb41e952c1ddc3f5a4ffa31b3d77527a14b92c2fe3dd0e41e4493b4cdd71bccfa331fe9a4ebe
SSDEEP

3072:h8/ZYewg05GPA+aQquRYNJaQO9bW/6q+muUlNgLTc+wAYWipg+gjLYAXI:hqhDPA8quRwJaQO9bu6q+OlC8+CxcI

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

7f8df94d65bc34318b54811941b186c11da1524a0d7878e8203a11a72e3ecf4b
.exe windows x86

30c7f4e3cf8ee22b82ee0f03747dea48

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/03/2010, 00:00

Not After

08/03/2011, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:44:85:92:2c:75:5e:c7:a0:8b:91:26:9e:ef:7c:5d:3d:48:de:f2
Signer

Actual PE Digest

7b:44:85:92:2c:75:5e:c7:a0:8b:91:26:9e:ef:7c:5d:3d:48:de:f2

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

07/09/2010, 17:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsA
OpenProcess
FreeEnvironmentStringsW
CreateFileW
SleepEx
GetEnvironmentStringsW
GetVersion
GetSystemDefaultLCID
SetLocaleInfoA
lstrcpynA
GetCurrentThread
EnumDateFormatsW
Beep
GetAtomNameA
GetCommandLineW
VirtualAlloc
CreateMailslotW
GetWindowsDirectoryW
GetCurrentDirectoryA
GetModuleHandleW

user32

MonitorFromWindow
CharNextA
wsprintfW
DrawIcon
SetMenu
MessageBoxIndirectW
CharUpperA
DefWindowProcA
keybd_event
GetWindowTextA
GetForegroundWindow
SetWindowRgn
FlashWindow
GetClassInfoA
GetMenuItemCount
CharNextW
DialogBoxIndirectParamA
RegisterClassExW
SendDlgItemMessageA
EndDialog
GetMenuItemRect
PostQuitMessage
GetCursorPos
ClientToScreen
UnregisterClassA
OpenClipboard
SetCursorPos
MessageBoxW
GetSystemMetrics
CharLowerA
BringWindowToTop
GetDC
LoadBitmapW
DefFrameProcA
CreateWindowExA
SetWindowPos
SetDlgItemInt
EndMenu

gdi32

CloseEnhMetaFile
FillRgn
DescribePixelFormat
CreateSolidBrush
GetMetaFileBitsEx
SetArcDirection
EnumFontFamiliesW
GetObjectType
DeleteEnhMetaFile
SetColorAdjustment
AddFontResourceA
CreateFontIndirectExA
ResizePalette
GetMiterLimit
GetViewportOrgEx
CopyEnhMetaFileW
BitBlt

advapi32

RegCreateKeyW
RegOpenKeyExW

shell32

SHCoCreateInstance
StrStrW
ShellExecuteA

shlwapi

SHRegEnumUSKeyA
PathFindSuffixArrayW

comctl32

ImageList_SetFilter
ImageList_DragEnter

comdlg32

PrintDlgA

ole32

CoGetPSClsid
CLSIDFromProgID

version

VerLanguageNameW

ws2_32

WSAStartup
WSAAccept
WSAGetLastError

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30c7f4e3cf8ee22b82ee0f03747dea48

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4aCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

7b:44:85:92:2c:75:5e:c7:a0:8b:91:26:9e:ef:7c:5d:3d:48:de:f2Signer

Signature Validations

Verification

07/09/2010, 17:04 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comctl32

comdlg32

ole32

version

ws2_32

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 3KB - Virtual size: 2KB

UPX0 Size: - Virtual size: 3KB

UPX0 Size: - Virtual size: 7KB

.data Size: 6KB - Virtual size: 116KB

.rsrc Size: 119KB - Virtual size: 119KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4a
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

7b:44:85:92:2c:75:5e:c7:a0:8b:91:26:9e:ef:7c:5d:3d:48:de:f2
Signer

07/09/2010, 17:04
Valid: false

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 3KB - Virtual size: 2KB

UPX0
Size: - Virtual size: 3KB

UPX0
Size: - Virtual size: 7KB

.data
Size: 6KB - Virtual size: 116KB

.rsrc
Size: 119KB - Virtual size: 119KB