669300dcd562fa56ca68920bd02f932784389c82415280ab29d5ba2788560415

Resubmissions

26/03/2023, 16:49

230326-vbt2asbb9w 7

14/03/2023, 08:14

230314-j5c44agd4s 7

14/03/2023, 04:59

230314-fmmc9sdd79 7

Sharing

Copy URL Twitter E-mail

General

Target

669300dcd562fa56ca68920bd02f932784389c82415280ab29d5ba2788560415
Size

1.6MB
MD5

838eaa6343e3b6d085a23f5b3fbfa802
SHA1

9a520e0b4c6733bdf78bbe7773097d461d7a98f1
SHA256

669300dcd562fa56ca68920bd02f932784389c82415280ab29d5ba2788560415
SHA512

73f8e820dc9e79510b9064d2db4fc47e0215886804945ca1945e58aa41908a0ee76ffb65a5fd360308a5371b4165d5033989988feb1a072b7bea64652ea07e06
SSDEEP

49152:eoxkhpmJKp0ZKXL2cmziF4OzP4Q463qETCvJa+J/:xymJy00zmzi397qETCBa+J/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

669300dcd562fa56ca68920bd02f932784389c82415280ab29d5ba2788560415
.exe windows x64

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:93:00:d5:99:01:60:67:a3:e8:6c:ed
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

08/09/2017, 12:04

Not After

08/09/2020, 12:04

Subject

CN=IP Izmaylov Artem Andreevich,O=IP Izmaylov Artem Andreevich,L=Tula,ST=Tula oblast,C=RU,1.2.840.113549.1.9.1=#0c0f737570706f72744061696d702e7275

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:93:00:d5:99:01:60:67:a3:e8:6c:ed
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

08/09/2017, 12:04

Not After

08/09/2020, 12:04

Subject

CN=IP Izmaylov Artem Andreevich,O=IP Izmaylov Artem Andreevich,L=Tula,ST=Tula oblast,C=RU,1.2.840.113549.1.9.1=#0c0f737570706f72744061696d702e7275

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:09:bb:3c:1e:9f:8c:39:e2:e3:a3:34:5b:85:5f:3d:bd:ac:c3:1b
Signer

Actual PE Digest

32:09:bb:3c:1e:9f:8c:39:e2:e3:a3:34:5b:85:5f:3d:bd:ac:c3:1b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=IP Izmaylov Artem Andreevich,O=IP Izmaylov Artem Andreevich,L=Tula,ST=Tula oblast,C=RU,1.2.840.113549.1.9.1=#0c0f737570706f72744061696d702e7275

25/03/2020, 08:57
Valid: true

Chain 1

CN=IP Izmaylov Artem Andreevich,O=IP Izmaylov Artem Andreevich,L=Tula,ST=Tula oblast,C=RU,1.2.840.113549.1.9.1=#0c0f737570706f72744061696d702e7275

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

a3:3b:38:e2:05:35:3b:fe:c6:0c:ae:b9:90:6b:a9:3a:86:05:69:53:13:75:e2:28:5e:b7:74:ee:52:25:03:5f
Signer

Actual PE Digest

a3:3b:38:e2:05:35:3b:fe:c6:0c:ae:b9:90:6b:a9:3a:86:05:69:53:13:75:e2:28:5e:b7:74:ee:52:25:03:5f

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=IP Izmaylov Artem Andreevich,O=IP Izmaylov Artem Andreevich,L=Tula,ST=Tula oblast,C=RU,1.2.840.113549.1.9.1=#0c0f737570706f72744061696d702e7275

25/03/2020, 08:57
Valid: true

Chain 1

CN=IP Izmaylov Artem Andreevich,O=IP Izmaylov Artem Andreevich,L=Tula,ST=Tula oblast,C=RU,1.2.840.113549.1.9.1=#0c0f737570706f72744061696d702e7275

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

32:93:00:d5:99:01:60:67:a3:e8:6c:edCertificate

Extended Key Usages

Key Usages

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

32:93:00:d5:99:01:60:67:a3:e8:6c:edCertificate

Extended Key Usages

Key Usages

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

32:09:bb:3c:1e:9f:8c:39:e2:e3:a3:34:5b:85:5f:3d:bd:ac:c3:1bSigner

Signature Validations

Verification

25/03/2020, 08:57 Valid: true

Chain 1

a3:3b:38:e2:05:35:3b:fe:c6:0c:ae:b9:90:6b:a9:3a:86:05:69:53:13:75:e2:28:5e:b7:74:ee:52:25:03:5fSigner

Signature Validations

Verification

25/03/2020, 08:57 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.8MB

UPX1 Size: 1.6MB - Virtual size: 1.6MB

UPX2 Size: 512B - Virtual size: 4KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

32:93:00:d5:99:01:60:67:a3:e8:6c:ed
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

32:93:00:d5:99:01:60:67:a3:e8:6c:ed
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

32:09:bb:3c:1e:9f:8c:39:e2:e3:a3:34:5b:85:5f:3d:bd:ac:c3:1b
Signer

25/03/2020, 08:57
Valid: true

a3:3b:38:e2:05:35:3b:fe:c6:0c:ae:b9:90:6b:a9:3a:86:05:69:53:13:75:e2:28:5e:b7:74:ee:52:25:03:5f
Signer

25/03/2020, 08:57
Valid: true

UPX0
Size: - Virtual size: 3.8MB

UPX1
Size: 1.6MB - Virtual size: 1.6MB

UPX2
Size: 512B - Virtual size: 4KB