041efa16f9140eaf6ee895fcad1262e6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

041efa16f9140eaf6ee895fcad1262e6
Size

1.5MB
MD5

041efa16f9140eaf6ee895fcad1262e6
SHA1

426893e6f0c41a43a7e6c571f9273c455bc24024
SHA256

88b7f115eb9f239b9e23efdfe7af928c020d9c844fd5d65d7f88843c04ce5dbf
SHA512

e292925f5bffbf8ad47e3a5142b4cb53517d5d787396748bc44ad347c25a2ffa5510a2718943e85129a7c162e9077cd73ed704860562324eb7d95e9fb4297c07
SSDEEP

49152:EPfvsdwCNi3fXbynHB4MTUiMNWjj7TBx:EPfvEyfrySInhnn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

041efa16f9140eaf6ee895fcad1262e6
.exe windows:5 windows x86 arch:x86

Code Sign

7f:61:65:22:d2:87:e8:5a:40:98:4a:2c:01:c4:14:c1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

17/06/2014, 00:00

Not After

17/06/2015, 23:59

Subject

CN=Smart Secure Software S.l.,O=Smart Secure Software S.l.,L=Adeje,ST=Santa Cruz de Tenerife,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

b7:89:ae:8b:2d:fd:63:e9:3a:22:ea:d2:19:73:34:c7:ea:d2:c6:37
Signer

Actual PE Digest

b7:89:ae:8b:2d:fd:63:e9:3a:22:ea:d2:19:73:34:c7:ea:d2:c6:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE