be00c94d168105e27a7d3f39f85b29767b6b3d605c947c5e45b90a9bba957d3b[.]exe[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

be00c94d168105e27a7d3f39f85b29767b6b3d605c947c5e45b90a9bba957d3b.exe.zip
Size

52.0MB
MD5

a86c1a6ed4a65e9046ad7c39edf95bc4
SHA1

d8d24fe33558b9cdd4188e885a3bf9d634f48fd4
SHA256

be4fbfb3f3dc33bccdc3f3053e8c6b4a7252e2f60d1026fcc5b76f8ec253285d
SHA512

844dfa693263cd411c08c305a04ae12b1311322a96ca3747860e4ce2e3b1d4f34c472a737c8b5d93b1e22664cb2a16a0186b24da57f8b9350577bce0e7c10f40
SSDEEP

1572864:lCibIP3DOgmpq6jUl6ccla/BFA1hjn6KoidBjI:Bz9Fcn/kbjn6KoidBU

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/be00c94d168105e27a7d3f39f85b29767b6b3d605c947c5e45b90a9bba957d3b.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/out.upx

Files

be00c94d168105e27a7d3f39f85b29767b6b3d605c947c5e45b90a9bba957d3b.exe.zip
.zip

Password: infected
be00c94d168105e27a7d3f39f85b29767b6b3d605c947c5e45b90a9bba957d3b.exe
.exe windows:6 windows x86

Code Sign

5f:53:cf:f8:5b:b2:e1:30:a4:a7:62:70
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17-11-2020 15:57

Not After

18-11-2021 15:57

Subject

SERIALNUMBER=08071145,CN=WATERFOX LIMITED,O=WATERFOX LIMITED,STREET=Arthur G Mead Ltd\, Fitzrovia House\, 153-157 Cleveland Street\,,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c18616c6578407761746572666f7870726f6a6563742e6f7267,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9c:8a:fc:48:e4:53:68:e6:04:e0:db:f3:f8:0e:39:5f:50:ea:fe:9f:3b:a5:cd:ae:7b:27:a7:c0:1b:bf:dc:2a
Signer

Actual PE Digest

9c:8a:fc:48:e4:53:68:e6:04:e0:db:f3:f8:0e:39:5f:50:ea:fe:9f:3b:a5:cd:ae:7b:27:a7:c0:1b:bf:dc:2a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 324KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 109KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Code Sign

5f:53:cf:f8:5b:b2:e1:30:a4:a7:62:70Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

9c:8a:fc:48:e4:53:68:e6:04:e0:db:f3:f8:0e:39:5f:50:ea:fe:9f:3b:a5:cd:ae:7b:27:a7:c0:1b:bf:dc:2aSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 324KB

UPX1 Size: 109KB - Virtual size: 112KB

.rsrc Size: 178KB - Virtual size: 180KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 156KB - Virtual size: 156KB

.rdata Size: 45KB - Virtual size: 44KB

.data Size: 5KB - Virtual size: 16KB

.rsrc Size: 178KB - Virtual size: 177KB

.reloc Size: 10KB - Virtual size: 10KB

5f:53:cf:f8:5b:b2:e1:30:a4:a7:62:70
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

9c:8a:fc:48:e4:53:68:e6:04:e0:db:f3:f8:0e:39:5f:50:ea:fe:9f:3b:a5:cd:ae:7b:27:a7:c0:1b:bf:dc:2a
Signer

UPX0
Size: - Virtual size: 324KB

UPX1
Size: 109KB - Virtual size: 112KB

.rsrc
Size: 178KB - Virtual size: 180KB

.text
Size: 156KB - Virtual size: 156KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 5KB - Virtual size: 16KB

.rsrc
Size: 178KB - Virtual size: 177KB

.reloc
Size: 10KB - Virtual size: 10KB