e65a8e743ab9371c6f4afccb55cf9e48f9403be1e1c0389bd7689e80a92b2b1e

Sharing

Copy URL Twitter E-mail

General

Target

e65a8e743ab9371c6f4afccb55cf9e48f9403be1e1c0389bd7689e80a92b2b1e
Size

2.5MB
MD5

adab001c615da88124f4165c78910ddb
SHA1

735ac74f92b5b46e004566f91209e46f0f897c56
SHA256

e65a8e743ab9371c6f4afccb55cf9e48f9403be1e1c0389bd7689e80a92b2b1e
SHA512

7d62485882b79e051eee6f8552afdb7f8240083131b817f2f60bed373b30255535912437aca93df2750dedba489851f5aa76515d5d66d18bf3db4967ea8239f5
SSDEEP

49152:DRG5IlbCtDnDl1W70r/7KFnQ9p8S/nkb18hG6mKQ:lG5IRCd+0XcnXAJQ6S

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

e65a8e743ab9371c6f4afccb55cf9e48f9403be1e1c0389bd7689e80a92b2b1e
.exe windows x86

c4a827fc0065e39e6de25dd6c39155eb

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:2c:cb:a9:49:bb:94:24:e9:8f:41:6f:ad:41
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:84:90:a4:44:40:da:1f:d7:91:c9:4d:da:50:9e:95:b0
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

15/12/2015, 15:04

Not After

15/12/2018, 15:04

Subject

CN=ABBYY Production LLC,O=ABBYY Production LLC,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:2e:00:be:6d:1d:9d:be:31:34:34:e9
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

28/02/2018, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign TSA for Standard - G3 - 002-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01/09/1998, 12:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:2c:cb:a9:49:bb:94:24:e9:8f:41:6f:ad:41
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:84:90:a4:44:40:da:1f:d7:91:c9:4d:da:50:9e:95:b0
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

15/12/2015, 15:04

Not After

15/12/2018, 15:04

Subject

CN=ABBYY Production LLC,O=ABBYY Production LLC,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:b7:74:ee:59:e3:5e:c6:06:26:16:89
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

28/02/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 002-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:63:ac:a0:38:d5:77:be:ea:af:b2:af:36:d0:c7:92:43:ae:ff:b5:c2:57:03:e2:04:f1:34:1d:88:ae:0b:c0
Signer

Actual PE Digest

72:63:ac:a0:38:d5:77:be:ea:af:b2:af:36:d0:c7:92:43:ae:ff:b5:c2:57:03:e2:04:f1:34:1d:88:ae:0b:c0

Digest Algorithm

sha256

PE Digest Matches

false

13:b7:44:63:3a:c9:04:0a:5e:75:59:bf:07:88:00:22:8c:ed:06:5c
Signer

Actual PE Digest

13:b7:44:63:3a:c9:04:0a:5e:75:59:bf:07:88:00:22:8c:ed:06:5c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
SizeofResource
FindResourceW
WriteFile
LeaveCriticalSection
EnterCriticalSection
DeleteFileW
GetSystemDirectoryW
TerminateProcess
ResumeThread
QueueUserAPC
LoadLibraryW
CreateProcessW
GetExitCodeProcess
Sleep
CreateThread
GetCurrentThreadId
DeleteCriticalSection
SetLastError
FlushInstructionCache
lstrcmpiW
CompareStringW
FreeLibrary
LoadLibraryExW
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetSystemTimeAsFileTime
GetFileSize
GetTickCount
LockResource
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ReadFile
GetStartupInfoW
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InterlockedDecrement
LoadLibraryA
lstrlenW
RaiseException
SetEndOfFile
GetProcessHeap
InterlockedCompareExchange
InitializeCriticalSection
OutputDebugStringW
DebugBreak
InterlockedIncrement
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
CreateFileW
OpenProcess
GetModuleFileNameW
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CloseHandle
GetModuleHandleW
GetProcAddress
CreateRemoteThread
WaitForSingleObject
OutputDebugStringA
GetVersionExW
GetCurrentProcess
GetCurrentProcessId
GetLastError
IsProcessorFeaturePresent

user32

FillRect
GetSysColor
CallWindowProcW
DrawFocusRect
IsWindowEnabled
GetFocus
GetDlgCtrlID
DrawTextW
ReleaseDC
GetDC
OffsetRect
SetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SystemParametersInfoW
GetClassNameW
LoadCursorW
ScreenToClient
GetCursorPos
GetCapture
ReleaseCapture
SetFocus
SetCapture
UpdateWindow
PtInRect
SetCursor
InvalidateRect
EndPaint
BeginPaint
CreateDialogParamW
EndDialog
DialogBoxParamW
IsWindow
SetRectEmpty
DestroyWindow
DefWindowProcW
GetDlgItem
PostQuitMessage
CheckDlgButton
IsDlgButtonChecked
GetActiveWindow
SetDlgItemTextW
SetWindowTextW
GetParent
GetWindow
GetWindowRect
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SendMessageW
GetSystemMetrics
LoadImageW
RegisterWindowMessageW
IsDialogMessageW
GetClassInfoW
RegisterClassW
ShowWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
MessageBoxW
CharNextW
LoadStringW
CreateWindowExW
UnregisterClassA

gdi32

SetBkMode
GetObjectW
GetStockObject
SelectObject
CreateFontIndirectW
DeleteDC
DeleteObject
SetTextColor

comdlg32

GetOpenFileNameW

advapi32

RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW

shell32

ShellExecuteW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

SysAllocString
VarUI4FromStr
SysFreeString

shlwapi

PathFileExistsW
PathRemoveFileSpecW
SHSetValueW

comctl32

InitCommonControlsEx
_TrackMouseEvent

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX
Size: 830KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4a827fc0065e39e6de25dd6c39155eb

Code Sign

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:2c:cb:a9:49:bb:94:24:e9:8f:41:6f:ad:41Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

11:21:84:90:a4:44:40:da:1f:d7:91:c9:4d:da:50:9e:95:b0Certificate

Extended Key Usages

Key Usages

6d:2e:00:be:6d:1d:9d:be:31:34:34:e9Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:15:4b:5a:c3:94Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

47:2c:cb:a9:49:bb:94:24:e9:8f:41:6f:ad:41Certificate

Extended Key Usages

Key Usages

11:21:84:90:a4:44:40:da:1f:d7:91:c9:4d:da:50:9e:95:b0Certificate

Extended Key Usages

Key Usages

13:b7:74:ee:59:e3:5e:c6:06:26:16:89Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

72:63:ac:a0:38:d5:77:be:ea:af:b2:af:36:d0:c7:92:43:ae:ff:b5:c2:57:03:e2:04:f1:34:1d:88:ae:0b:c0Signer

13:b7:44:63:3a:c9:04:0a:5e:75:59:bf:07:88:00:22:8c:ed:06:5cSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

msvcrt

iphlpapi

psapi

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.UPX Size: 830KB - Virtual size: 832KB

.idata Size: 5KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 32KB

.UPX Size: 4KB - Virtual size: 4KB

04:00:00:00:00:01:21:58:53:08:a2
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:2c:cb:a9:49:bb:94:24:e9:8f:41:6f:ad:41
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

11:21:84:90:a4:44:40:da:1f:d7:91:c9:4d:da:50:9e:95:b0
Certificate

6d:2e:00:be:6d:1d:9d:be:31:34:34:e9
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

47:2c:cb:a9:49:bb:94:24:e9:8f:41:6f:ad:41
Certificate

11:21:84:90:a4:44:40:da:1f:d7:91:c9:4d:da:50:9e:95:b0
Certificate

13:b7:74:ee:59:e3:5e:c6:06:26:16:89
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

72:63:ac:a0:38:d5:77:be:ea:af:b2:af:36:d0:c7:92:43:ae:ff:b5:c2:57:03:e2:04:f1:34:1d:88:ae:0b:c0
Signer

13:b7:44:63:3a:c9:04:0a:5e:75:59:bf:07:88:00:22:8c:ed:06:5c
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.UPX
Size: 830KB - Virtual size: 832KB

.idata
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 32KB

.UPX
Size: 4KB - Virtual size: 4KB