MTADiag[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

MTADiag.exe
Size

279KB
MD5

fa834d0f8bb50f2eac6384518a16ef54
SHA1

75a4ca8a55ac80051ee2ce3ac20a377486684e84
SHA256

645f257200f2c3256f6c2287853296da2a91c710cebfbce7749271b66ff22245
SHA512

01f2e4945c0957e64cbf5b4b4fe03cd5716617fd25d602442ef20f297d50a113ca76f709bf8c84a7b8ec2f9b5187f8f0d72a4e885c1a7d1e2d4f13e254e4a3d6
SSDEEP

6144:XeB7lFnJvAvSWac8RJVn/hnW3Vzy7NFZvSSALavtXsgQk+:XejFnJIv4Wxy7BOQXRK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

MTADiag.exe
.exe windows x86

Code Sign

61:3b:c7:91:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 20:15

Not After

15-04-2021 20:25

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:8d:a6:4b:7b:d5:2c:4f:d1:8e:a4:cb:bb:86:9d:b6
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

03-08-2022 10:16

Not After

02-08-2024 10:16

Subject

CN=Hans Roes,O=Hans Roes,L=Tielen,C=BE,1.2.840.113549.1.9.1=#0c1568616e732e63657274756d406d6f6470726f2e6265

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28-07-2022 08:56

Not After

27-07-2033 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:d0:6f:e1:34:c6:43:14:6c:c0:35:05:68:48:6f:21:d5:a7:cb:f9:1f:6b:a3:69:a6:4b:b0:e5:cc:c9:20:e4
Signer

Actual PE Digest

78:d0:6f:e1:34:c6:43:14:6c:c0:35:05:68:48:6f:21:d5:a7:cb:f9:1f:6b:a3:69:a6:4b:b0:e5:cc:c9:20:e4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 428KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 261KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

61:3b:c7:91:00:00:00:00:00:34Certificate

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

32:8d:a6:4b:7b:d5:2c:4f:d1:8e:a4:cb:bb:86:9d:b6Certificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

78:d0:6f:e1:34:c6:43:14:6c:c0:35:05:68:48:6f:21:d5:a7:cb:f9:1f:6b:a3:69:a6:4b:b0:e5:cc:c9:20:e4Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 428KB

UPX1 Size: 261KB - Virtual size: 264KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 452KB - Virtual size: 451KB

.rdata Size: 138KB - Virtual size: 138KB

.data Size: 32KB - Virtual size: 36KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 28KB - Virtual size: 28KB

61:3b:c7:91:00:00:00:00:00:34
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

32:8d:a6:4b:7b:d5:2c:4f:d1:8e:a4:cb:bb:86:9d:b6
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

78:d0:6f:e1:34:c6:43:14:6c:c0:35:05:68:48:6f:21:d5:a7:cb:f9:1f:6b:a3:69:a6:4b:b0:e5:cc:c9:20:e4
Signer

UPX0
Size: - Virtual size: 428KB

UPX1
Size: 261KB - Virtual size: 264KB

.rsrc
Size: 4KB - Virtual size: 8KB

.text
Size: 452KB - Virtual size: 451KB

.rdata
Size: 138KB - Virtual size: 138KB

.data
Size: 32KB - Virtual size: 36KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 28KB - Virtual size: 28KB