87e972da66bacaf8f49fe9e339c19da1f38c202a5556a1c77e912dd77bcccab2

Sharing

Copy URL Twitter E-mail

General

Target

87e972da66bacaf8f49fe9e339c19da1f38c202a5556a1c77e912dd77bcccab2
Size

163KB
MD5

8189b136b906bff661271e92fc6b17e5
SHA1

1b3295e90992f7538524b51fc32a533f09d4fcd1
SHA256

87e972da66bacaf8f49fe9e339c19da1f38c202a5556a1c77e912dd77bcccab2
SHA512

65d17e2678ebe56e0c23a959617ff3a8ff7835df41698d750e2699d15cb9ae52932e996c2e082cea32a3448fe66c4e58688400184ded25b204316f8bd45434a2
SSDEEP

3072:+Dj0675t5qamrcKLKIjDdAZ8K/wuBzxdz+BtAR3oM2hOOu8hI0al:wAu5tTm4KLKIj5AZ8K/bzxd+BtABoM2A

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

87e972da66bacaf8f49fe9e339c19da1f38c202a5556a1c77e912dd77bcccab2
.exe windows:6 windows x86 arch:x86

Code Sign

33:00:00:03:8c:ad:cb:66:95:90:08:80:f4:00:00:00:00:03:8c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/08/2023, 18:28

Not After

07/08/2024, 18:28

Subject

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dc:82:5d:2d:54:2d:76:c5:9c:e8:d4:4f:d0:2e:33:c7:13:86:33:aa:f7:67:e9:07:b9:93:d7:db:ad:82:cc:1f
Signer

Actual PE Digest

dc:82:5d:2d:54:2d:76:c5:9c:e8:d4:4f:d0:2e:33:c7:13:86:33:aa:f7:67:e9:07:b9:93:d7:db:ad:82:cc:1f

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 504KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 149KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:03:8c:ad:cb:66:95:90:08:80:f4:00:00:00:00:03:8cCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

dc:82:5d:2d:54:2d:76:c5:9c:e8:d4:4f:d0:2e:33:c7:13:86:33:aa:f7:67:e9:07:b9:93:d7:db:ad:82:cc:1fSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 504KB

UPX1 Size: 149KB - Virtual size: 152KB

.rsrc Size: 3KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 201KB - Virtual size: 200KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 353KB - Virtual size: 353KB

.reloc Size: 9KB - Virtual size: 8KB

33:00:00:03:8c:ad:cb:66:95:90:08:80:f4:00:00:00:00:03:8c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

dc:82:5d:2d:54:2d:76:c5:9c:e8:d4:4f:d0:2e:33:c7:13:86:33:aa:f7:67:e9:07:b9:93:d7:db:ad:82:cc:1f
Signer

UPX0
Size: - Virtual size: 504KB

UPX1
Size: 149KB - Virtual size: 152KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 201KB - Virtual size: 200KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 353KB - Virtual size: 353KB

.reloc
Size: 9KB - Virtual size: 8KB