PeaceSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

PeaceSetup.exe
Size

10.2MB
MD5

4c91f5051e08c580c42dc13f25edf530
SHA1

fd6add5b9507f2b1c8d11314ca6d44f33be5e5bf
SHA256

e469ba318e29416947dc8fbc3baf13844d0b29075496127e759d0b317b02140f
SHA512

2fbe865b6f310b5e4a9cce5abbc25aa8a23fe60444a155fead6f6511b22cd9bf32e5eafe4284400f1f74994fa796e99ce984f7287a0595e0bcbdd27618fb4801
SSDEEP

196608:H5J35GdmkekO2zJvJQ7n1xveEdhDR5WdvwR3Nqd9cGQfKT8SKFl2e6vRt:Hb5G4kePQv6nBWpJd9cpKT8S0IR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/out.upx	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

PeaceSetup.exe
.exe windows x86

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:eb:10:b9:7c:15:88:05:ab:45:90:20:ea:ba:c9:29
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

15/05/2019, 10:06

Not After

14/05/2020, 10:06

Subject

CN=Open Source Developer\, Petrus Verbeek,O=Open Source Developer,L=Alblasserdam,ST=Zuid-Holland,C=NL,1.2.840.113549.1.9.1=#0c1670652e7665726265656b363640676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:27:a6:f0:98:2f:76:18:88:9a:04:e2:72:26:6a:54:d6:00:9d:1f:73:0c:fe:3e:55:43:86:e6:9d:67:98:16
Signer

Actual PE Digest

68:27:a6:f0:98:2f:76:18:88:9a:04:e2:72:26:6a:54:d6:00:9d:1f:73:0c:fe:3e:55:43:86:e6:9d:67:98:16

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.2MB - Virtual size: 12.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

76:eb:10:b9:7c:15:88:05:ab:45:90:20:ea:ba:c9:29Certificate

Extended Key Usages

Key Usages

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

68:27:a6:f0:98:2f:76:18:88:9a:04:e2:72:26:6a:54:d6:00:9d:1f:73:0c:fe:3e:55:43:86:e6:9d:67:98:16Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 8.3MB

UPX1 Size: 4.8MB - Virtual size: 4.8MB

.rsrc Size: 5.4MB - Virtual size: 5.4MB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 568KB - Virtual size: 567KB

.rdata Size: 191KB - Virtual size: 191KB

.data Size: 20KB - Virtual size: 35KB

.rsrc Size: 12.2MB - Virtual size: 12.2MB

.reloc Size: 28KB - Virtual size: 28KB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

76:eb:10:b9:7c:15:88:05:ab:45:90:20:ea:ba:c9:29
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

68:27:a6:f0:98:2f:76:18:88:9a:04:e2:72:26:6a:54:d6:00:9d:1f:73:0c:fe:3e:55:43:86:e6:9d:67:98:16
Signer

UPX0
Size: - Virtual size: 8.3MB

UPX1
Size: 4.8MB - Virtual size: 4.8MB

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

.text
Size: 568KB - Virtual size: 567KB

.rdata
Size: 191KB - Virtual size: 191KB

.data
Size: 20KB - Virtual size: 35KB

.rsrc
Size: 12.2MB - Virtual size: 12.2MB

.reloc
Size: 28KB - Virtual size: 28KB