eb5273660bff0638dd4133f7007ef480a046a15962899799d763490e9889990e

Sharing

Copy URL Twitter E-mail

General

Target

eb5273660bff0638dd4133f7007ef480a046a15962899799d763490e9889990e
Size

3.3MB
MD5

9dea4ed2b0236fe010ba45ad4b7fc93f
SHA1

310bc46c718eb939eb6c88d8843607e2da44e79a
SHA256

eb5273660bff0638dd4133f7007ef480a046a15962899799d763490e9889990e
SHA512

c31e19d53046b7661ea080e57aefe034bfdf8bbfb5f3ed2ec4bd9b85167d17654bbfecce3acfa4c7ddbfa390ad8fa73d1462036f5bd6c40e1055baefa626f02c
SSDEEP

49152:QUTsamMx03t/m0WWazZ5UsbHpoSk0oN0+TvKjDLaG8Za4b+lyokcBexqF:Qac3te0WWQ5Ukp1k0o6smDL+a4YyVxqF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/out.upx	autoit_exe

Files

eb5273660bff0638dd4133f7007ef480a046a15962899799d763490e9889990e
.exe windows x86

Code Sign

04:44:c0
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

22/10/2008, 12:07

Not After

31/12/2029, 12:07

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:05:fd:22:b2:6d:3d:62:12:f4:98:2d:69:67:68:6a
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

12/03/2019, 11:27

Not After

11/06/2020, 11:27

Subject

CN=厦门仁优网络科技有限公司,O=厦门仁优网络科技有限公司,L=厦门市,ST=福建省,C=CN,1.2.840.113549.1.9.1=#0c10786d72656e796f75403136332e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1f:fb:83:7d:0d:bd:46:ea:56:f6:6f:4c:bb:6e:3e:16:a4:6a:ff:4b:5d:5d:01:06:11:d6:69:4f:fe:0b:46:cf
Signer

Actual PE Digest

1f:fb:83:7d:0d:bd:46:ea:56:f6:6f:4c:bb:6e:3e:16:a4:6a:ff:4b:5d:5d:01:06:11:d6:69:4f:fe:0b:46:cf

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=厦门仁优网络科技有限公司,O=厦门仁优网络科技有限公司,L=厦门市,ST=福建省,C=CN,1.2.840.113549.1.9.1=#0c10786d72656e796f75403136332e636f6d

27/02/2023, 09:32
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 335KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:44:c0Certificate

Key Usages

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

0c:05:fd:22:b2:6d:3d:62:12:f4:98:2d:69:67:68:6aCertificate

Extended Key Usages

Key Usages

1f:fb:83:7d:0d:bd:46:ea:56:f6:6f:4c:bb:6e:3e:16:a4:6a:ff:4b:5d:5d:01:06:11:d6:69:4f:fe:0b:46:cfSigner

Signature Validations

Verification

27/02/2023, 09:32 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.5MB

UPX1 Size: 335KB - Virtual size: 336KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 557KB - Virtual size: 557KB

.rdata Size: 179KB - Virtual size: 179KB

.data Size: 24KB - Virtual size: 39KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 41KB - Virtual size: 41KB

04:44:c0
Certificate

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

0c:05:fd:22:b2:6d:3d:62:12:f4:98:2d:69:67:68:6a
Certificate

1f:fb:83:7d:0d:bd:46:ea:56:f6:6f:4c:bb:6e:3e:16:a4:6a:ff:4b:5d:5d:01:06:11:d6:69:4f:fe:0b:46:cf
Signer

27/02/2023, 09:32
Valid: false

UPX0
Size: - Virtual size: 2.5MB

UPX1
Size: 335KB - Virtual size: 336KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.text
Size: 557KB - Virtual size: 557KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 24KB - Virtual size: 39KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 41KB - Virtual size: 41KB