unpack200[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

unpack200.exe
Size

157KB
MD5

63f75627217c2790c1c30b58511313f9
SHA1

24c7b528b697d32e1b957d7229668e36bff9b3fb
SHA256

f806d859f2f0474e92b554ac7a66f3d74bc6a5606f605eff5b88e56861952dc9
SHA512

32f01141b8d1c7a0b6541e8647494a6cd7251165dcab71ee058e96b3b2de7357d39c912e42e0a060a4c34b1ac3ea39c66da6b14cb16042b5eb0873c50a946bd8
SSDEEP

3072:+55PvV8HVwLZ8qYpI0EAWfL4JVBTBfveag9zQHvlIG/lv:FHVqZw20tsL4hTBneag9zQHvb

Score

1^/10

Malware Config

Signatures

Files

unpack200.exe
.exe windows x86

172861d7f771518bba27ebb10e326cd9

Code Sign

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26/02/2018, 00:00

Not After

27/02/2020, 23:59

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9a:52:a3:c4:7a:4c:01:13:ad:eb:d6:c8:3b:d6:e3:fe:a9:0e:34:85:7d:1e:f9:ed:f2:f3:0b:df:d8:00:bb:f1
Signer

Actual PE Digest

9a:52:a3:c4:7a:4c:01:13:ad:eb:d6:c8:3b:d6:e3:fe:a9:0e:34:85:7d:1e:f9:ed:f2:f3:0b:df:d8:00:bb:f1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

strcmp
strchr
remove
fclose
exit
fopen
_time64
strcat
strncat
fflush
qsort
_snprintf
atoi
strcpy
abort
_gmtime64
fwrite
_amsg_exit
__getmainargs
strncmp
_exit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
getenv
strtok
fprintf
strrchr
fread
__iob_func
_errno
sprintf
strlen
memcmp
realloc
memchr
free
malloc
memset
_cexit
memcpy
_strdup
_fileno
_mkdir

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

172861d7f771518bba27ebb10e326cd9

Code Sign

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

9a:52:a3:c4:7a:4c:01:13:ad:eb:d6:c8:3b:d6:e3:fe:a9:0e:34:85:7d:1e:f9:ed:f2:f3:0b:df:d8:00:bb:f1Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

kernel32

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 4KB - Virtual size: 5KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

9a:52:a3:c4:7a:4c:01:13:ad:eb:d6:c8:3b:d6:e3:fe:a9:0e:34:85:7d:1e:f9:ed:f2:f3:0b:df:d8:00:bb:f1
Signer

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB