d4fc8415802d26f5902a925dafa09f95[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

d4fc8415802d26f5902a925dafa09f95.bin
Size

3.7MB
MD5

1d3ab40ec7cdfa8f1a76abd6499543c2
SHA1

b6fd9576123acd3ceae94b1b7139ec6fb8038f6c
SHA256

ce83770a03ddb0a885e1bfa237f190c18f88ba84361896cbb476f1b31189b5f8
SHA512

33636349092a9b1a66e6dcf1e54ba4ab530f9278d9eb2cd7b6928c2b8a4c2936f6b39b3e67a29435a109c345923cac316af535e521541006865ed7f03ac7ad8f
SSDEEP

98304:xecn8mtZVE7lz+JX41EdwNf8Lp8YTLkGEG:xRn8mi7lz+541EdwNf8l8YTwGJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f.exe	upx

Files

d4fc8415802d26f5902a925dafa09f95.bin
.zip

Password: infected
b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f.exe
.exe windows x64

Password: infected

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-07-2020 00:00

Not After

09-07-2023 23:59

Subject

SERIALNUMBER=91110101593898951F,CN=Lespeed Technology Co.\, Ltd,O=Lespeed Technology Co.\, Ltd,POSTALCODE=100028,STREET=Chaoyang District+STREET=Room 1610\, Haocheng Building\, No.9 Building\, No.6 Courtyard\, Zuojiazhuang Middle Street,L=Beijing,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-07-2020 00:00

Not After

09-07-2023 23:59

Subject

SERIALNUMBER=91110101593898951F,CN=Lespeed Technology Co.\, Ltd,O=Lespeed Technology Co.\, Ltd,POSTALCODE=100028,STREET=Chaoyang District+STREET=Room 1610\, Haocheng Building\, No.9 Building\, No.6 Courtyard\, Zuojiazhuang Middle Street,L=Beijing,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:16:32:fc:77:10:73:62:ce:33:8b:78:ab:e4:7c:7b:f5:26:26:68:d3:db:37:aa:a9:41:c0:75:d6:c0:53:53
Signer

Actual PE Digest

08:16:32:fc:77:10:73:62:ce:33:8b:78:ab:e4:7c:7b:f5:26:26:68:d3:db:37:aa:a9:41:c0:75:d6:c0:53:53

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91110101593898951F,CN=Lespeed Technology Co.\, Ltd,O=Lespeed Technology Co.\, Ltd,POSTALCODE=100028,STREET=Chaoyang District+STREET=Room 1610\, Haocheng Building\, No.9 Building\, No.6 Courtyard\, Zuojiazhuang Middle Street,L=Beijing,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

16-03-2023 15:36
Valid: true

Chain 1

SERIALNUMBER=91110101593898951F,CN=Lespeed Technology Co.\, Ltd,O=Lespeed Technology Co.\, Ltd,POSTALCODE=100028,STREET=Chaoyang District+STREET=Room 1610\, Haocheng Building\, No.9 Building\, No.6 Courtyard\, Zuojiazhuang Middle Street,L=Beijing,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

00:3f:1e:a8:5d:d5:88:57:98:4d:9f:e0:09:29:cc:f2:2c:bf:73:d0
Signer

Actual PE Digest

00:3f:1e:a8:5d:d5:88:57:98:4d:9f:e0:09:29:cc:f2:2c:bf:73:d0

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91110101593898951F,CN=Lespeed Technology Co.\, Ltd,O=Lespeed Technology Co.\, Ltd,POSTALCODE=100028,STREET=Chaoyang District+STREET=Room 1610\, Haocheng Building\, No.9 Building\, No.6 Courtyard\, Zuojiazhuang Middle Street,L=Beijing,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

16-03-2023 15:36
Valid: true

Chain 1

SERIALNUMBER=91110101593898951F,CN=Lespeed Technology Co.\, Ltd,O=Lespeed Technology Co.\, Ltd,POSTALCODE=100028,STREET=Chaoyang District+STREET=Room 1610\, Haocheng Building\, No.9 Building\, No.6 Courtyard\, Zuojiazhuang Middle Street,L=Beijing,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 87KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75Certificate

Extended Key Usages

Key Usages

08:16:32:fc:77:10:73:62:ce:33:8b:78:ab:e4:7c:7b:f5:26:26:68:d3:db:37:aa:a9:41:c0:75:d6:c0:53:53Signer

Signature Validations

Verification

16-03-2023 15:36 Valid: true

Chain 1

00:3f:1e:a8:5d:d5:88:57:98:4d:9f:e0:09:29:cc:f2:2c:bf:73:d0Signer

Signature Validations

Verification

16-03-2023 15:36 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 152KB

UPX1 Size: 87KB - Virtual size: 88KB

.rsrc Size: 19KB - Virtual size: 20KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 143KB - Virtual size: 143KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 3KB - Virtual size: 20KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 19KB - Virtual size: 18KB

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75
Certificate

08:16:32:fc:77:10:73:62:ce:33:8b:78:ab:e4:7c:7b:f5:26:26:68:d3:db:37:aa:a9:41:c0:75:d6:c0:53:53
Signer

16-03-2023 15:36
Valid: true

00:3f:1e:a8:5d:d5:88:57:98:4d:9f:e0:09:29:cc:f2:2c:bf:73:d0
Signer

16-03-2023 15:36
Valid: true

UPX0
Size: - Virtual size: 152KB

UPX1
Size: 87KB - Virtual size: 88KB

.rsrc
Size: 19KB - Virtual size: 20KB

.text
Size: 143KB - Virtual size: 143KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 3KB - Virtual size: 20KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 19KB - Virtual size: 18KB