ajuda[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ajuda.exe
Size

8.2MB
MD5

46ee676a3bf446c3326153504a38a588
SHA1

23161b645d7f88ea9280d15177792b12cb604e78
SHA256

e72b511aa105e7aa134e699a4cd10c2422744bd41592baaf311d5ba859af23c4
SHA512

662e7e35d903af28e09a61096f3f16d2c363b5eef9b388365a7da0699f4b2da4305fad699ac4d66ea8b5a10cff166755678fb809ad6762864ec1331de58a2339
SSDEEP

196608:AfUjaGQZieTflROeWygyoj/eZPHLyKIHsBRPVbNgkOQJjdiF2HPpB3k4uYWfkp4:A8jqZieBROeWZyobetdPVbNyQJjdRHhu

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

ajuda.exe
.exe windows x86

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:78:44:51:8a:57:31:88:8f:63:a7:69:1b:ce:b7:75
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/10/2021, 00:00

Not After

04/12/2024, 23:59

Subject

SERIALNUMBER=AP - 111997,CN=Nanosystems S.r.l.,OU=IT,O=Nanosystems S.r.l.,L=Ascoli Piceno,ST=Ascoli Piceno,C=IT,1.3.6.1.4.1.311.60.2.1.2=#130d4173636f6c6920506963656e6f,1.3.6.1.4.1.311.60.2.1.3=#13024954,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:78:44:51:8a:57:31:88:8f:63:a7:69:1b:ce:b7:75
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/10/2021, 00:00

Not After

04/12/2024, 23:59

Subject

SERIALNUMBER=AP - 111997,CN=Nanosystems S.r.l.,OU=IT,O=Nanosystems S.r.l.,L=Ascoli Piceno,ST=Ascoli Piceno,C=IT,1.3.6.1.4.1.311.60.2.1.2=#130d4173636f6c6920506963656e6f,1.3.6.1.4.1.311.60.2.1.3=#13024954,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:36:6b:ec:bb:e2:9f:ee:e2:38:6c:30:09:f2:cf:cd:6c:4f:47:ba:f1:88:ac:65:c5:40:89:c8:31:97:f2:a8
Signer

Actual PE Digest

e4:36:6b:ec:bb:e2:9f:ee:e2:38:6c:30:09:f2:cf:cd:6c:4f:47:ba:f1:88:ac:65:c5:40:89:c8:31:97:f2:a8

Digest Algorithm

sha256

PE Digest Matches

true

07:70:07:da:55:ab:2e:0f:7b:8c:f3:4f:a0:46:97:5e:c1:61:16:ce
Signer

Actual PE Digest

07:70:07:da:55:ab:2e:0f:7b:8c:f3:4f:a0:46:97:5e:c1:61:16:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 29.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

01:78:44:51:8a:57:31:88:8f:63:a7:69:1b:ce:b7:75Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:78:44:51:8a:57:31:88:8f:63:a7:69:1b:ce:b7:75Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

e4:36:6b:ec:bb:e2:9f:ee:e2:38:6c:30:09:f2:cf:cd:6c:4f:47:ba:f1:88:ac:65:c5:40:89:c8:31:97:f2:a8Signer

07:70:07:da:55:ab:2e:0f:7b:8c:f3:4f:a0:46:97:5e:c1:61:16:ceSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 29.5MB

UPX1 Size: 8.0MB - Virtual size: 8.0MB

.rsrc Size: 115KB - Virtual size: 116KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

01:78:44:51:8a:57:31:88:8f:63:a7:69:1b:ce:b7:75
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:78:44:51:8a:57:31:88:8f:63:a7:69:1b:ce:b7:75
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

e4:36:6b:ec:bb:e2:9f:ee:e2:38:6c:30:09:f2:cf:cd:6c:4f:47:ba:f1:88:ac:65:c5:40:89:c8:31:97:f2:a8
Signer

07:70:07:da:55:ab:2e:0f:7b:8c:f3:4f:a0:46:97:5e:c1:61:16:ce
Signer

UPX0
Size: - Virtual size: 29.5MB

UPX1
Size: 8.0MB - Virtual size: 8.0MB

.rsrc
Size: 115KB - Virtual size: 116KB