Behavioral task
behavioral1
Sample
9f9f4a9f5aac2d552b8949324d4f0aa1a597df746eaf05bf9b56824796e7192c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9f9f4a9f5aac2d552b8949324d4f0aa1a597df746eaf05bf9b56824796e7192c.exe
Resource
win10v2004-20221111-en
General
-
Target
9f9f4a9f5aac2d552b8949324d4f0aa1a597df746eaf05bf9b56824796e7192c
-
Size
1.2MB
-
MD5
7ada156f9908b8c0e3d0652e5324f341
-
SHA1
bd63bfd140360956adff80a108870a16eb091223
-
SHA256
9f9f4a9f5aac2d552b8949324d4f0aa1a597df746eaf05bf9b56824796e7192c
-
SHA512
7ad93c4f98513a69147cbaae3795bcc7861d20fd43993a2d7d405586dd3a2e302db5c5fa100c75f40609c3d439affc79447b879ccb9e0bb3bb61334451afa6e5
-
SSDEEP
24576:kU6x40H6GvoHy8fivQrArw3ALcwdQ8yhI4bpL8Ag+MaBSkG0rOVl5kTSTc:kZ/6GEy8fdGwIc6Q8OI4l1xDEk/rIlmv
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
9f9f4a9f5aac2d552b8949324d4f0aa1a597df746eaf05bf9b56824796e7192c.exe windows x86
Code Sign
50:ff:f0:c0:f0:0e:74:73:bd:68:f4:1b:97:1e:e7:47Certificate
IssuerCN=zhuxian,O=Mao,1.2.840.113549.1.9.1=#0c134d657465696f6340686f746d61696c2e636f6dNot Before08/08/2021, 03:18Not After31/12/2039, 23:59SubjectCN=zhuxian,O=Mao,1.2.840.113549.1.9.1=#0c134d657465696f6340686f746d61696c2e636f6d1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6Certificate
IssuerCN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CNNot Before01/01/2000, 00:00Not After31/12/2099, 23:59SubjectCN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CNExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
1e:b1:32:d5:7e:79:68:96Certificate
IssuerCN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CNNot Before01/01/2000, 00:00Not After31/12/2099, 23:59SubjectCN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CNExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
81:7d:27:1d:7c:34:20:ee:14:6c:01:e6:35:a1:c2:a8:93:24:18:32Signer
Actual PE Digest81:7d:27:1d:7c:34:20:ee:14:6c:01:e6:35:a1:c2:a8:93:24:18:32Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=zhuxian,O=Mao,1.2.840.113549.1.9.1=#0c134d657465696f6340686f746d61696c2e636f6d01/04/2011, 00:00 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 820KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 817KB - Virtual size: 816KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 973KB - Virtual size: 973KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ