525a441b42c067ed94782ac34ea18b382fb798dde51a4620f0379cd209febd11[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

525a441b42c067ed94782ac34ea18b382fb798dde51a4620f0379cd209febd11.exe.zip
Size

5.4MB
MD5

dd402dd721d1a6dd9a0831378215aa7d
SHA1

dabb6b619ed338fd0dd9e8baba4d40c63b70035f
SHA256

7b9e960ad6f7142a902cddd292eab77f9262ee32a829c1cee086ba9e273ee514
SHA512

6eb3c5cd052cc7a5666431eaeddcd9aa248f6e00fc8462ff5c80a6faba35c5d6b40976cea480fdff1420efa622699a9f69250ffdcaf91e01d16369a05d9801f0
SSDEEP

98304:5FQtgXLDB3B3TXK7xaTvXXaDMmguCT8YK9yIqN66a0aI/ID:5KtgRx3TXKUT/qDMmgEYKfC3HQD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/525a441b42c067ed94782ac34ea18b382fb798dde51a4620f0379cd209febd11.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/out.upx

Files

525a441b42c067ed94782ac34ea18b382fb798dde51a4620f0379cd209febd11.exe.zip
.zip

Password: infected
525a441b42c067ed94782ac34ea18b382fb798dde51a4620f0379cd209febd11.exe
.exe windows:4 windows x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07:bc:3a:51:b5:89:e5:af:43:29:1d:f8:4e:a4:c5:71
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/12/2011, 00:00

Not After

25/12/2014, 23:59

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f6:5a:16:e2:9c:99:70:a0:1d:b4:cf:f8:d5:70:b4:47:a0:3c:fc:e9
Signer

Actual PE Digest

f6:5a:16:e2:9c:99:70:a0:1d:b4:cf:f8:d5:70:b4:47:a0:3c:fc:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 508KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 387KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 552KB - Virtual size: 548KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

07:bc:3a:51:b5:89:e5:af:43:29:1d:f8:4e:a4:c5:71Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f6:5a:16:e2:9c:99:70:a0:1d:b4:cf:f8:d5:70:b4:47:a0:3c:fc:e9Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 508KB

UPX1 Size: 387KB - Virtual size: 388KB

.rsrc Size: 85KB - Virtual size: 88KB

Headers

File Characteristics

Sections

.text Size: 552KB - Virtual size: 548KB

.rdata Size: 100KB - Virtual size: 98KB

.data Size: 20KB - Virtual size: 38KB

.rsrc Size: 192KB - Virtual size: 188KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

07:bc:3a:51:b5:89:e5:af:43:29:1d:f8:4e:a4:c5:71
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f6:5a:16:e2:9c:99:70:a0:1d:b4:cf:f8:d5:70:b4:47:a0:3c:fc:e9
Signer

UPX0
Size: - Virtual size: 508KB

UPX1
Size: 387KB - Virtual size: 388KB

.rsrc
Size: 85KB - Virtual size: 88KB

.text
Size: 552KB - Virtual size: 548KB

.rdata
Size: 100KB - Virtual size: 98KB

.data
Size: 20KB - Virtual size: 38KB

.rsrc
Size: 192KB - Virtual size: 188KB