b0633c7ac239fad0d475b8a267f88f4d9338a0c3b1b4065cfaad906db45566e0

Sharing

Copy URL

Twitter E-mail

General

Target

b0633c7ac239fad0d475b8a267f88f4d9338a0c3b1b4065cfaad906db45566e0
Size

415KB
MD5

2512439a3b59eb9e0356f9314e8d93e6
SHA1

003f4ce770c16104887cfbf82af4665ef0780c03
SHA256

b0633c7ac239fad0d475b8a267f88f4d9338a0c3b1b4065cfaad906db45566e0
SHA512

1ce62ce4fedc29c684275f56f87b97fe0ce0b01119ddb24f6e29e37143dfa2b122cf0c98da5c14b060b67fe75526ddce20ec2e1217ee25e1f2d0367696db2f3e
SSDEEP

12288:vOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiq5d:vq5TfcdHj4fmbD5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/out.upx	autoit_exe

Files

b0633c7ac239fad0d475b8a267f88f4d9338a0c3b1b4065cfaad906db45566e0
.exe windows x86

Code Sign

5c:2e:94:0a:c9:cc:59:25:9b:0b:cb:d3:8a:ee:d9:dd
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

12/03/2019, 13:04

Not After

11/06/2020, 13:04

Subject

CN=Xiamen Jubaoshang Network Technology Co.\, Ltd.,O=Xiamen Jubaoshang Network Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN,1.2.840.113549.1.9.1=#0c0e6a62736e6574403136332e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4a:d1:1f:87:70:0c:57:a6:9a:92:0a:2d:11:e2:77:cb:17:3b:3d:6a:2e:a9:7a:84:7b:86:1b:7c:2a:11:25:0c
Signer

Actual PE Digest

4a:d1:1f:87:70:0c:57:a6:9a:92:0a:2d:11:e2:77:cb:17:3b:3d:6a:2e:a9:7a:84:7b:86:1b:7c:2a:11:25:0c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Xiamen Jubaoshang Network Technology Co.\, Ltd.,O=Xiamen Jubaoshang Network Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN,1.2.840.113549.1.9.1=#0c0e6a62736e6574403136332e636f6d

27/02/2023, 09:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 596KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 334KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

5c:2e:94:0a:c9:cc:59:25:9b:0b:cb:d3:8a:ee:d9:ddCertificate

Extended Key Usages

Key Usages

4a:d1:1f:87:70:0c:57:a6:9a:92:0a:2d:11:e2:77:cb:17:3b:3d:6a:2e:a9:7a:84:7b:86:1b:7c:2a:11:25:0cSigner

Signature Validations

Verification

27/02/2023, 09:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 596KB

UPX1 Size: 334KB - Virtual size: 336KB

.rsrc Size: 78KB - Virtual size: 80KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 557KB - Virtual size: 557KB

.rdata Size: 179KB - Virtual size: 179KB

.data Size: 24KB - Virtual size: 39KB

.rsrc Size: 77KB - Virtual size: 76KB

.reloc Size: 41KB - Virtual size: 41KB

5c:2e:94:0a:c9:cc:59:25:9b:0b:cb:d3:8a:ee:d9:dd
Certificate

4a:d1:1f:87:70:0c:57:a6:9a:92:0a:2d:11:e2:77:cb:17:3b:3d:6a:2e:a9:7a:84:7b:86:1b:7c:2a:11:25:0c
Signer

27/02/2023, 09:36
Valid: false

UPX0
Size: - Virtual size: 596KB

UPX1
Size: 334KB - Virtual size: 336KB

.rsrc
Size: 78KB - Virtual size: 80KB

.text
Size: 557KB - Virtual size: 557KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 24KB - Virtual size: 39KB

.rsrc
Size: 77KB - Virtual size: 76KB

.reloc
Size: 41KB - Virtual size: 41KB