b7a7bbe7e06f219f34b8b081bc2935448975d9c008ea57576b0cd1077ce0ac1b

Sharing

Copy URL Twitter E-mail

General

Target

b7a7bbe7e06f219f34b8b081bc2935448975d9c008ea57576b0cd1077ce0ac1b
Size

52KB
MD5

1cd838255d50d076e3be2ec83ac7689f
SHA1

2aaf619d9d2e12dde1f59129f372ce0471408081
SHA256

b7a7bbe7e06f219f34b8b081bc2935448975d9c008ea57576b0cd1077ce0ac1b
SHA512

03dbcb61662e8062c6ebf87f591f44f581e09d238ff81669711db1a58f1fd7a16d9d1c678ab1b7ebdd0b8e90d0ffde708aac56658f46564c8ee30a7e0b05bad6
SSDEEP

768:oGmGDsLWrwCEeb8hYCxLh4h/Mjs6RQeGLerJ1dereDeNcH0s0dB8WfG6xebProWZ:FTjO7hY+4h/36RQ/0lJ2cH0R8WfEUWZ

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

b7a7bbe7e06f219f34b8b081bc2935448975d9c008ea57576b0cd1077ce0ac1b
.dll windows x86

Code Sign

23:a3:18:c1:da:ae:6c:2f:62:01:45:f5:59:84:96:85
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

01/03/2016, 08:06

Not After

01/06/2019, 08:06

Subject

CN=恒生电子股份有限公司,O=恒生电子股份有限公司,L=杭州市,ST=浙江省,C=CN,1.2.840.113549.1.9.1=#0c1768736e775f77696e6e65724068756e6473756e2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:07:fa:b0:93:1f:94:37:e4:85:87:b2:ac:ad:9d:34:db:66:10:82
Signer

Actual PE Digest

63:07:fa:b0:93:1f:94:37:e4:85:87:b2:ac:ad:9d:34:db:66:10:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

fadd
fchg
fget
getconnectstate
gettperrno
gettpurcode
pushmsg
regpushclient
sethassafecfg
setproxy
setsafecfg
subscribe
tpacall
tpacallfundno
tpalloc
tpallterm
tpcall
tpcallconnid
tpcallex
tpcallfundno
tpcallfundnoex
tpchkauth
tpclose
tpconnect
tpconnectex
tpfree
tpgetctxt
tpgetrealip
tpgetrply
tpinit
tpinitex
tpsetcontxt
tpsetctxt
tpsetrectimeout
tpsetroutername
tpstrerror
tpterm
tuxgetenv
tuxputenv
unregpushclient
unsubscribe

Sections

CODE
Size: 29KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

23:a3:18:c1:da:ae:6c:2f:62:01:45:f5:59:84:96:85Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

63:07:fa:b0:93:1f:94:37:e4:85:87:b2:ac:ad:9d:34:db:66:10:82Signer

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 29KB - Virtual size: 84KB

DATA Size: 512B - Virtual size: 4KB

BSS Size: - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 16KB

.edata Size: 1024B - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 8KB

.rsrc Size: 1024B - Virtual size: 4KB

.aspack Size: 8KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

23:a3:18:c1:da:ae:6c:2f:62:01:45:f5:59:84:96:85
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

63:07:fa:b0:93:1f:94:37:e4:85:87:b2:ac:ad:9d:34:db:66:10:82
Signer

CODE
Size: 29KB - Virtual size: 84KB

DATA
Size: 512B - Virtual size: 4KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 16KB

.edata
Size: 1024B - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 4KB

.aspack
Size: 8KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB