237d385b3c63aa42d78007731a6c507781848ea5858294092c26968803659ba2

Sharing

Copy URL

Twitter E-mail

General

Target

237d385b3c63aa42d78007731a6c507781848ea5858294092c26968803659ba2
Size

840KB
MD5

df39afdd2cdc28e849ad2a42afd450f2
SHA1

12df9857b1593932761236ad8b78c7ccb764d379
SHA256

237d385b3c63aa42d78007731a6c507781848ea5858294092c26968803659ba2
SHA512

900bc453bab3f61a1a7449da2ab6aea0b26ca794aaae89af88c0795ab52778bc47051ce4cb664114ac8d4c290d384c903386787bb7ba6d47825cf85223f78b4a
SSDEEP

24576:w7rVcjbEUws3L24GRH4q5wnIKywIsu8N2Wk:wsbEELgHtWnI1P8N2Wk

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
aspackv2

Processes:

resource yara_rule

sample aspack_v212_v242

resource	yara_rule
sample	aspack_v212_v242

Files

237d385b3c63aa42d78007731a6c507781848ea5858294092c26968803659ba2
.exe windows x86

Code Sign

45:46:79:c4:63:b6:35:06:c8:31:6c:0c:12:68:eb:66
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

01-12-2014 07:47

Not After

01-12-2015 07:47

Subject

CN=南京奋斗网络科技有限公司,O=南京奋斗网络科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

92:d0:7c:61:c2:83:77:9b:c8:c6:25:f5:22:f8:d4:43:1a:ef:83:9b
Signer

Actual PE Digest

92:d0:7c:61:c2:83:77:9b:c8:c6:25:f5:22:f8:d4:43:1a:ef:83:9b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 522KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 17KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 143KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

45:46:79:c4:63:b6:35:06:c8:31:6c:0c:12:68:eb:66Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

92:d0:7c:61:c2:83:77:9b:c8:c6:25:f5:22:f8:d4:43:1a:ef:83:9bSigner

Headers

File Characteristics

Sections

CODE Size: 522KB - Virtual size: 1.5MB

DATA Size: 17KB - Virtual size: 28KB

BSS Size: - Virtual size: 8KB

.idata Size: 4KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 96KB

.rsrc Size: 144KB - Virtual size: 984KB

.aspack Size: 143KB - Virtual size: 144KB

.adata Size: - Virtual size: 4KB

45:46:79:c4:63:b6:35:06:c8:31:6c:0c:12:68:eb:66
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

3d
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

92:d0:7c:61:c2:83:77:9b:c8:c6:25:f5:22:f8:d4:43:1a:ef:83:9b
Signer

CODE
Size: 522KB - Virtual size: 1.5MB

DATA
Size: 17KB - Virtual size: 28KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 4KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 96KB

.rsrc
Size: 144KB - Virtual size: 984KB

.aspack
Size: 143KB - Virtual size: 144KB

.adata
Size: - Virtual size: 4KB