ec4e9044e4537c6dc7e18722a525b07feb2ba08dbf1dc25648b6d373ce0164a1

Sharing

Copy URL Twitter E-mail

General

Target

ec4e9044e4537c6dc7e18722a525b07feb2ba08dbf1dc25648b6d373ce0164a1
Size

598KB
MD5

5a43e6b07ebb0c7a147d8f63117e3fcd
SHA1

1f9ac2950c94754e4c0f65d7e916d8d1d1dccacd
SHA256

ec4e9044e4537c6dc7e18722a525b07feb2ba08dbf1dc25648b6d373ce0164a1
SHA512

0c17cc732e70727fcb95175974bc3e34b98df2745cd0239c68e42dc5af695d1c0e6e44f38d9d4d2ffc584d82db7857c709bd63d1a4a6e256fb7ce6315189823c
SSDEEP

12288:yg8KPgoZOUDPubGngDpos3+dAJdQPaUgITIqUo7eHkPAsTeJZ5rc:24xOL+gDpo5cdkaUZT9Ut8HTerQ

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

ec4e9044e4537c6dc7e18722a525b07feb2ba08dbf1dc25648b6d373ce0164a1
.exe windows x86

Code Sign

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:e7:56:27:67:b6:1c
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/06/2012, 05:17

Not After

10/06/2013, 03:41

Subject

CN=江苏易乐网络科技有限公司,O=江苏易乐网络科技有限公司,L=镇江市,ST=江苏省,C=CN,1.2.840.113549.1.9.1=#0c107369676e4079696c657765622e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

52:c4:24:c4:ba:e5:3b:81:e5:74:a4:a2:3e:4b:8c:04:31:18:57:fd
Signer

Actual PE Digest

52:c4:24:c4:ba:e5:3b:81:e5:74:a4:a2:3e:4b:8c:04:31:18:57:fd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=江苏易乐网络科技有限公司,O=江苏易乐网络科技有限公司,L=镇江市,ST=江苏省,C=CN,1.2.840.113549.1.9.1=#0c107369676e4079696c657765622e636f6d

13/01/2023, 12:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 544KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

19:9d:f8:8eCertificate

Key Usages

11:e7:56:27:67:b6:1cCertificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

01Certificate

Key Usages

52:c4:24:c4:ba:e5:3b:81:e5:74:a4:a2:3e:4b:8c:04:31:18:57:fdSigner

Signature Validations

Verification

13/01/2023, 12:38 Valid: false

Headers

File Characteristics

Sections

.text Size: 25KB - Virtual size: 48KB

.rdata Size: 3KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 12KB

.rsrc Size: 544KB - Virtual size: 2.2MB

.aspack Size: 16KB - Virtual size: 20KB

.adata Size: - Virtual size: 4KB

19:9d:f8:8e
Certificate

11:e7:56:27:67:b6:1c
Certificate

3d
Certificate

01
Certificate

52:c4:24:c4:ba:e5:3b:81:e5:74:a4:a2:3e:4b:8c:04:31:18:57:fd
Signer

13/01/2023, 12:38
Valid: false

.text
Size: 25KB - Virtual size: 48KB

.rdata
Size: 3KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 12KB

.rsrc
Size: 544KB - Virtual size: 2.2MB

.aspack
Size: 16KB - Virtual size: 20KB

.adata
Size: - Virtual size: 4KB