8dabe214f17bc69225875466676b464cf665f852f61a599c85a76b308f5187ef

Sharing

Copy URL

Twitter E-mail

General

Target

8dabe214f17bc69225875466676b464cf665f852f61a599c85a76b308f5187ef
Size

514KB
MD5

01c5ce532c9302e67382ad107827cee2
SHA1

d5024e8483fd3b1ea9d6c44d3b5e0de715006c73
SHA256

8dabe214f17bc69225875466676b464cf665f852f61a599c85a76b308f5187ef
SHA512

e63b38355742a4b01f1fc265c444fd8fd94079a1c5bdb47f02f07bd3eaf17123452aa5c3efe79560c4b8acfb87956eb4be07e604d7ab734871e358436852a200
SSDEEP

12288:pw7V9UTfsVQz/p1bYjDFWQ7sBSdIRzKRKgWPRPJBqDQOK3voa:pw72fXpt7vodIdKR6PRhBqW3Qa

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

8dabe214f17bc69225875466676b464cf665f852f61a599c85a76b308f5187ef
.exe windows x86

Code Sign

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

29/01/2016, 09:18

Not After

29/03/2017, 09:18

Subject

CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

Issuer

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5:7e:79:68:96
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

3a:68:b5:01:4c:c5:51:c7:a2:ea:7a:5c:15:ac:28:90:41:c9:0d:4e
Signer

Actual PE Digest

3a:68:b5:01:4c:c5:51:c7:a2:ea:7a:5c:15:ac:28:90:41:c9:0d:4e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

18/03/2017, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ecode
Size: 479KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.beyond
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4bCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6Certificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5Certificate

Key Usages

1e:b1:32:d5:7e:79:68:96Certificate

Extended Key Usages

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

01Certificate

Key Usages

3a:68:b5:01:4c:c5:51:c7:a2:ea:7a:5c:15:ac:28:90:41:c9:0d:4eSigner

Signature Validations

Verification

18/03/2017, 00:00 Valid: false

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.ecode Size: 479KB - Virtual size: 2.7MB

.rsrc Size: 512B - Virtual size: 20KB

.beyond Size: 20KB - Virtual size: 20KB

.adata Size: - Virtual size: 4KB

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b
Certificate

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

1e:b1:32:d5
Certificate

1e:b1:32:d5:7e:79:68:96
Certificate

19:c2:85:30:e9:3b:36
Certificate

01
Certificate

3a:68:b5:01:4c:c5:51:c7:a2:ea:7a:5c:15:ac:28:90:41:c9:0d:4e
Signer

18/03/2017, 00:00
Valid: false

.text
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.ecode
Size: 479KB - Virtual size: 2.7MB

.rsrc
Size: 512B - Virtual size: 20KB

.beyond
Size: 20KB - Virtual size: 20KB

.adata
Size: - Virtual size: 4KB