a907f8ac505a0e1aeb84eca05a77b6b5a4cd8d004ad70c98b991baee0bd40e34

Sharing

Copy URL Twitter E-mail

General

Target

a907f8ac505a0e1aeb84eca05a77b6b5a4cd8d004ad70c98b991baee0bd40e34
Size

3.5MB
MD5

1fd63978438f1ace18662475ac7909b7
SHA1

574f20efb30dfae37a62cf2effd93f7d5ad17d5c
SHA256

a907f8ac505a0e1aeb84eca05a77b6b5a4cd8d004ad70c98b991baee0bd40e34
SHA512

ad11531d782b45d91a2bd03d72e26400b79f53f2cf3bbd2b1cd4dbd426d08fa9cac9f551df40152a6af2bd89847972911491d9bd867365b5bde4a03bc5176a16
SSDEEP

98304:tJ9Xb7Wmq5trnG9N96LJxiaJ9JJ9xTJVJJbxS:v1b7GrnG9P2JJ9xThJbxS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

a907f8ac505a0e1aeb84eca05a77b6b5a4cd8d004ad70c98b991baee0bd40e34
.exe windows:4 windows x86 arch:x86

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:15:a7:72:11:1a:ec:30:01:1b:e0:76:ce:fe:6e:81
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/03/2023, 00:00

Not After

01/04/2026, 23:59

Subject

CN=厦门美图之家科技有限公司,O=厦门美图之家科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:15:a7:72:11:1a:ec:30:01:1b:e0:76:ce:fe:6e:81
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/03/2023, 00:00

Not After

01/04/2026, 23:59

Subject

CN=厦门美图之家科技有限公司,O=厦门美图之家科技有限公司,L=厦门市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:8f:d2:4d:df:94:db:eb:e9:cf:3a:ef:50:9b:fc:4e:db:3a:f2:60:b8:e4:4c:ba:25:a2:f7:24:ad:f1:1b:4e
Signer

Actual PE Digest

bd:8f:d2:4d:df:94:db:eb:e9:cf:3a:ef:50:9b:fc:4e:db:3a:f2:60:b8:e4:4c:ba:25:a2:f7:24:ad:f1:1b:4e

Digest Algorithm

sha256

PE Digest Matches

false

11:64:8d:8a:4f:21:fd:ab:60:50:63:21:5c:6c:cf:f6:c0:62:af:79
Signer

Actual PE Digest

11:64:8d:8a:4f:21:fd:ab:60:50:63:21:5c:6c:cf:f6:c0:62:af:79

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 465KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:15:a7:72:11:1a:ec:30:01:1b:e0:76:ce:fe:6e:81Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:15:a7:72:11:1a:ec:30:01:1b:e0:76:ce:fe:6e:81Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

bd:8f:d2:4d:df:94:db:eb:e9:cf:3a:ef:50:9b:fc:4e:db:3a:f2:60:b8:e4:4c:ba:25:a2:f7:24:ad:f1:1b:4eSigner

11:64:8d:8a:4f:21:fd:ab:60:50:63:21:5c:6c:cf:f6:c0:62:af:79Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.8MB

UPX1 Size: 465KB - Virtual size: 468KB

.rsrc Size: 3.0MB - Virtual size: 3.0MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:15:a7:72:11:1a:ec:30:01:1b:e0:76:ce:fe:6e:81
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:15:a7:72:11:1a:ec:30:01:1b:e0:76:ce:fe:6e:81
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

bd:8f:d2:4d:df:94:db:eb:e9:cf:3a:ef:50:9b:fc:4e:db:3a:f2:60:b8:e4:4c:ba:25:a2:f7:24:ad:f1:1b:4e
Signer

11:64:8d:8a:4f:21:fd:ab:60:50:63:21:5c:6c:cf:f6:c0:62:af:79
Signer

UPX0
Size: - Virtual size: 3.8MB

UPX1
Size: 465KB - Virtual size: 468KB

.rsrc
Size: 3.0MB - Virtual size: 3.0MB