30be48861a224ea365ff922cc1c6417bdbc9edcdcf74e408f950acdaa2a71322

Sharing

Copy URL Twitter E-mail

General

Target

30be48861a224ea365ff922cc1c6417bdbc9edcdcf74e408f950acdaa2a71322
Size

514KB
MD5

c8983b78b3ebb20c978dce758da9cfca
SHA1

620f8dc08edfcf3aefd3b45011c8369dc935dc36
SHA256

30be48861a224ea365ff922cc1c6417bdbc9edcdcf74e408f950acdaa2a71322
SHA512

1c01f233202f1108dbcee44aaa9ba778b6f4171037fd8dda633d91949be1ecc80ed8491b8f365c0e69c416977572ff86d1424640421a42a1c576caa172711b14
SSDEEP

12288:e7D0xWjsyDCNWlcIYC+H77IWb3PI/BwszX0Pr5BTGGlOBw:eDnZDCNWlcIWXIm3P8BJmrlOu

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

30be48861a224ea365ff922cc1c6417bdbc9edcdcf74e408f950acdaa2a71322
.exe windows x86

Code Sign

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

29/01/2016, 09:18

Not After

29/03/2017, 09:18

Subject

CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

Issuer

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5:7e:79:68:96
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

01:53:20:5f:48:20:2e:fa:0f:96:38:3c:3e:b3:77:18:4b:01:39:a3
Signer

Actual PE Digest

01:53:20:5f:48:20:2e:fa:0f:96:38:3c:3e:b3:77:18:4b:01:39:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ecode
Size: 480KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.beyond
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4bCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6Certificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5Certificate

Key Usages

1e:b1:32:d5:7e:79:68:96Certificate

Extended Key Usages

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

01Certificate

Key Usages

01:53:20:5f:48:20:2e:fa:0f:96:38:3c:3e:b3:77:18:4b:01:39:a3Signer

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.ecode Size: 480KB - Virtual size: 2.7MB

.rsrc Size: 512B - Virtual size: 20KB

.beyond Size: 20KB - Virtual size: 20KB

.adata Size: - Virtual size: 4KB

61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b
Certificate

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

1e:b1:32:d5
Certificate

1e:b1:32:d5:7e:79:68:96
Certificate

19:c2:85:30:e9:3b:36
Certificate

01
Certificate

01:53:20:5f:48:20:2e:fa:0f:96:38:3c:3e:b3:77:18:4b:01:39:a3
Signer

.text
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.ecode
Size: 480KB - Virtual size: 2.7MB

.rsrc
Size: 512B - Virtual size: 20KB

.beyond
Size: 20KB - Virtual size: 20KB

.adata
Size: - Virtual size: 4KB