ce034980ac5d46707ea073f9006842ee67217cba785bf3d47c498421f9e37144

Sharing

Copy URL Twitter E-mail

General

Target

ce034980ac5d46707ea073f9006842ee67217cba785bf3d47c498421f9e37144
Size

282KB
MD5

002e614a644d75ad19796c94f8d6dad1
SHA1

a13b29cc22e78e5511570fd80c55868a9365cb2f
SHA256

ce034980ac5d46707ea073f9006842ee67217cba785bf3d47c498421f9e37144
SHA512

db21995824a983cdab02edd208119be163369fd63838c90b535874f6062a0549922f66516b2a8083f5491860ba4024ab08ab8c8d0643208f5716049d30554e01
SSDEEP

6144:odoEhlW+wIdfPe072WfTuQfsknQ0clav3XO/y8Dv3Q4Zr3FIUMt:AoEhlV3deu3iQkePcgv3+a8r3Q4bI3t

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

ce034980ac5d46707ea073f9006842ee67217cba785bf3d47c498421f9e37144
.exe windows x86

Code Sign

69:e4:a4:b1:9e:70:7d:aa:de:6c:98:ba:c0:00:ac:8b
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

03/07/2015, 07:48

Not After

03/07/2017, 07:48

Subject

CN=Chengdu Jinding Shengshi Network Technology Co.\, Ltd.,O=Chengdu Jinding Shengshi Network Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c7:a7:fa:6a:bb:96:eb:01:34:19:76:0f:25:9b:43:a1:ed:c7:36:26
Signer

Actual PE Digest

c7:a7:fa:6a:bb:96:eb:01:34:19:76:0f:25:9b:43:a1:ed:c7:36:26

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Chengdu Jinding Shengshi Network Technology Co.\, Ltd.,O=Chengdu Jinding Shengshi Network Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

07/02/2023, 20:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 392KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 245KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 430KB - Virtual size: 429KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

69:e4:a4:b1:9e:70:7d:aa:de:6c:98:ba:c0:00:ac:8bCertificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

c7:a7:fa:6a:bb:96:eb:01:34:19:76:0f:25:9b:43:a1:ed:c7:36:26Signer

Signature Validations

Verification

07/02/2023, 20:40 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 392KB

UPX1 Size: 245KB - Virtual size: 248KB

.rsrc Size: 32KB - Virtual size: 36KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 430KB - Virtual size: 429KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 22KB - Virtual size: 32KB

.rsrc Size: 44KB - Virtual size: 43KB

69:e4:a4:b1:9e:70:7d:aa:de:6c:98:ba:c0:00:ac:8b
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

c7:a7:fa:6a:bb:96:eb:01:34:19:76:0f:25:9b:43:a1:ed:c7:36:26
Signer

07/02/2023, 20:40
Valid: false

UPX0
Size: - Virtual size: 392KB

UPX1
Size: 245KB - Virtual size: 248KB

.rsrc
Size: 32KB - Virtual size: 36KB

.text
Size: 430KB - Virtual size: 429KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 22KB - Virtual size: 32KB

.rsrc
Size: 44KB - Virtual size: 43KB