usf[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

usf.zip
Size

3.1MB
MD5

3d0ef73aa06bd500b5bef2b1937e88d2
SHA1

8f012f95f7908d50297fd68cea77ffab7f4e41ab
SHA256

b2a200172ce5e0c4dd4c8a51b7d8b9d6546b2810139666b135fb0e66463424fd
SHA512

8264880f229f5eacef7462fd4f524c23ca8f36827e25e9e9733dfdf67a78798e73c3efe08a70ee17fa7e5835a559403b70dbcd0619f985aecf3cd8173b1709d1
SSDEEP

49152:IiwPLWZ4K6J5TR/J5CPVW+f1SuEsZTWS5h3tnKzK2lk:IxLW96J5tJ5Qt0jsZZ2lk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/u.exe	upx

Files

usf.zip
.zip
u.exe
.exe windows:5 windows x86

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:d4:76:65:56:df:de:71:1f:5f:ae:b0
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

09-06-2021 11:48

Not After

09-06-2024 11:48

Subject

CN=Ultrareach Internet Corp.,O=Ultrareach Internet Corp.,L=Cheyenne,ST=Wyoming,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28-01-2021 11:08

Not After

01-03-2032 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:0c:ba:64:01:eb:c5:1c:00:ef:de:77:31:27:b3:40:e3:25:d8:cc:84:b2:ad:84:09:f6:11:55:98:4f:d0:fe
Signer

Actual PE Digest

8a:0c:ba:64:01:eb:c5:1c:00:ef:de:77:31:27:b3:40:e3:25:d8:cc:84:b2:ad:84:09:f6:11:55:98:4f:d0:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 9.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 150KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

79:d4:76:65:56:df:de:71:1f:5f:ae:b0Certificate

Extended Key Usages

Key Usages

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

8a:0c:ba:64:01:eb:c5:1c:00:ef:de:77:31:27:b3:40:e3:25:d8:cc:84:b2:ad:84:09:f6:11:55:98:4f:d0:feSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 9.6MB

UPX1 Size: 3.1MB - Virtual size: 3.1MB

.rsrc Size: 150KB - Virtual size: 152KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

79:d4:76:65:56:df:de:71:1f:5f:ae:b0
Certificate

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

8a:0c:ba:64:01:eb:c5:1c:00:ef:de:77:31:27:b3:40:e3:25:d8:cc:84:b2:ad:84:09:f6:11:55:98:4f:d0:fe
Signer

UPX0
Size: - Virtual size: 9.6MB

UPX1
Size: 3.1MB - Virtual size: 3.1MB

.rsrc
Size: 150KB - Virtual size: 152KB