6f0d88928237da5d1bbf17212e015c17f40c1c5ccb02364a2e9a0a2e1bc7c735

General

Target

6f0d88928237da5d1bbf17212e015c17f40c1c5ccb02364a2e9a0a2e1bc7c735
Size

6.2MB
MD5

2a85bd56b024c9bc681f1aef5ded796d
SHA1

2c8ca93e76dec4a273b36f0a90d7eceeaa24d521
SHA256

6f0d88928237da5d1bbf17212e015c17f40c1c5ccb02364a2e9a0a2e1bc7c735
SHA512

14c5dada37f786200fe26e25e1460170f1e933d40d1f06a916d94bb8d38ae33580db14778029040e73da1b0163249ed25dd7d9bf488b4fe64dc64322baa34109
SSDEEP

196608:RMvH8B6kMX54BW+tDKvTDexBbCIm55i4d+ND6hpaPmrgk4pxTmv1:RMUAk04BW4DMDgbrmr+NWfaPk4pE9

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

6f0d88928237da5d1bbf17212e015c17f40c1c5ccb02364a2e9a0a2e1bc7c735
.exe windows:4 windows x86

Code Sign

2c:f0:eb:4c:28:64:53:aa:45:4f:cd:c8:ce:cb:dd:c4
Certificate

Issuer

CN=ChongZi,O=虫子,1.2.840.113549.1.9.1=#0c11313631353435373733344071712e636f6d

Not Before

26/06/2014, 02:05

Not After

31/12/2039, 23:59

Subject

CN=ChongZi,O=虫子,1.2.840.113549.1.9.1=#0c11313631353435373733344071712e636f6d

cb:d7:1b:73:22:46:67:b4:86:d8:c1:44:ef:6d:52:56:1e:6f:18:1e
Signer

Actual PE Digest

cb:d7:1b:73:22:46:67:b4:86:d8:c1:44:ef:6d:52:56:1e:6f:18:1e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 404KB - Virtual size: 579KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

2c:f0:eb:4c:28:64:53:aa:45:4f:cd:c8:ce:cb:dd:c4Certificate

cb:d7:1b:73:22:46:67:b4:86:d8:c1:44:ef:6d:52:56:1e:6f:18:1eSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.8MB

UPX1 Size: 6.1MB - Virtual size: 6.1MB

.rsrc Size: 89KB - Virtual size: 92KB

Headers

File Characteristics

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 5.3MB - Virtual size: 5.3MB

.data Size: 404KB - Virtual size: 579KB

.rsrc Size: 96KB - Virtual size: 93KB

2c:f0:eb:4c:28:64:53:aa:45:4f:cd:c8:ce:cb:dd:c4
Certificate

cb:d7:1b:73:22:46:67:b4:86:d8:c1:44:ef:6d:52:56:1e:6f:18:1e
Signer

UPX0
Size: - Virtual size: 2.8MB

UPX1
Size: 6.1MB - Virtual size: 6.1MB

.rsrc
Size: 89KB - Virtual size: 92KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 5.3MB - Virtual size: 5.3MB

.data
Size: 404KB - Virtual size: 579KB

.rsrc
Size: 96KB - Virtual size: 93KB