13c1c6328658c59389cdf7d8c1c81a8f

General

Target
13c1c6328658c59389cdf7d8c1c81a8f
Size 234KB
Sample231225-k11v2agcb2
SHA256 e045ea342e07ea320e90711e00f61d8e608857403583781aaf4e17b21b257bff
MD5 13c1c6328658c59389cdf7d8c1c81a8f
SHA1 be37bbf8ddc083f08a819c46204be3e422c5ee6f
SHA512 deba83e23051d0284b656dce2512b8c3b568bf6646f9537edab1966f9cac3ce4364051bd50aa2e7adf0c7367aa5876265e6375c715d54c3e025271b57d022fda
SSDEEP 6144:n7c2llWCNo//Ij+qWr63tD/9BiQ7Rs8KhL/tSVGU:AZZIaqNZTiQ7QhL/t6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

13c1c6328658c59389cdf7d8c1c81a8f

.exe 234KB
out.upx

.exe 612KB

13c1c6328658c59389cdf7d8c1c81a8f

SHA256 e045ea342e07ea320e90711e00f61d8e608857403583781aaf4e17b21b257bff
MD5 13c1c6328658c59389cdf7d8c1c81a8f
SHA1 be37bbf8ddc083f08a819c46204be3e422c5ee6f
SHA512 deba83e23051d0284b656dce2512b8c3b568bf6646f9537edab1966f9cac3ce4364051bd50aa2e7adf0c7367aa5876265e6375c715d54c3e025271b57d022fda
SSDEEP 6144:n7c2llWCNo//Ij+qWr63tD/9BiQ7Rs8KhL/tSVGU:AZZIaqNZTiQ7QhL/t6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=SJ Dream,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SJ Dream,L=BUSAN,ST=GYEONGSANGNAM-DO,C=KR

Serial Number

30:07:a3:c8:de:2a:19:2a:34:54:d4:8e:dd:b5:97:16

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 25, 2009 - Mar 25, 2010

Minor OS version

0

Major OS version

4

Entry point

655984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 7ff5164ccb78458fc3d0eb98efb526f280b3d72058fff8edf9c892f8c1f69910
MD5 d50760c2939c864d680529254e3ad24a
SHA1 5af5b4dd3fdb8d7319e04e246c5c85176f7d6a43
SHA512 080be7b99c0a619e68f5d849a5cc91bdefce0a997e2c719b5c8136e0249a048d7dbf63dfea75f003c09225f3baa8b619c5f8ac85d50a50b75af1ca3fa406229f
SSDEEP 6144:aLTYhuhqh8ACFVxti+1e3UVtX3ZHHSHaVnwGYPATbFptSVG:cUmi+1e38X3ZHHS6ZQATvt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

193685

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

13c1c6328658c59389cdf7d8c1c81a8f

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

13c1c6328658c59389cdf7d8c1c81a8f

PE Signature issue

generic

out.upx

generic