0e0ecf54358b1b0adcc68d8b16139082

Sharing

Copy URL Twitter E-mail

General

Target

0e0ecf54358b1b0adcc68d8b16139082
Size

15.2MB
MD5

0e0ecf54358b1b0adcc68d8b16139082
SHA1

b16e61c9751f6b0565938f8e94a3eedf19093c6f
SHA256

fd0d9481fc462db4df26a6ae3890d37f8a6cd5db62474f40ab7975e48dc9bbd2
SHA512

b7a15aff36e773761f4e5daff6ed15ca6eb3935aeef94817bc2343a1743ed59ac5960053c5eba809daf5bb7e1bae5a89fadcbe3f4683e183395c74c95e5d7a21
SSDEEP

393216:n+SuN70bC+wuveOLO9pOhWhQ2434PNWWCVFxqA0MQrBd:n+Sww3GY4p7hp4IBCFqA0Mqr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/keygen.exe

Files

0e0ecf54358b1b0adcc68d8b16139082
.rar
keygen.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
setup.exe
.exe windows:1 windows x86 arch:x86

Code Sign

05:ab:96
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

01/02/2006, 21:44

Not After

30/01/2016, 21:44

Subject

CN=GeoTrust TrustCenter CodeSigning CA I,OU=GeoTrust TrustCenter CodeSigning CA,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:a9:00:01:00:20:ba:96:5f:e3:dc:47:1b:a8
Certificate

Issuer

CN=GeoTrust TrustCenter CodeSigning CA I,OU=GeoTrust TrustCenter CodeSigning CA,O=GeoTrust Inc,C=US

Not Before

25/08/2006, 14:34

Not After

25/08/2009, 14:34

Subject

CN=SiSoftware Ltd,OU=Development+OU=GeoTrust Code Signing,O=SiSoftware Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:35:8f
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

13/02/2006, 15:40

Not After

11/02/2016, 15:40

Subject

CN=GeoTrust TrustCenter Authenticode Timestamp I,OU=GeoTrust TrustCenter Timestamp,O=GeoTrust Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

63:92:0d:4d:a2:e0:2b:cf:1a:07:cb:ae:61:de:92:5e:9a:6d:15:de
Signer

Actual PE Digest

63:92:0d:4d:a2:e0:2b:cf:1a:07:cb:ae:61:de:92:5e:9a:6d:15:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

Size: - Virtual size: 180KB

Size: 90KB - Virtual size: 92KB

Code Sign

05:ab:96Certificate

Extended Key Usages

Key Usages

8d:a9:00:01:00:20:ba:96:5f:e3:dc:47:1b:a8Certificate

Extended Key Usages

Key Usages

02:35:8fCertificate

Extended Key Usages

Key Usages

63:92:0d:4d:a2:e0:2b:cf:1a:07:cb:ae:61:de:92:5e:9a:6d:15:deSigner

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 35KB

DATA Size: 1024B - Virtual size: 584B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 86KB - Virtual size: 85KB

05:ab:96
Certificate

8d:a9:00:01:00:20:ba:96:5f:e3:dc:47:1b:a8
Certificate

02:35:8f
Certificate

63:92:0d:4d:a2:e0:2b:cf:1a:07:cb:ae:61:de:92:5e:9a:6d:15:de
Signer

CODE
Size: 36KB - Virtual size: 35KB

DATA
Size: 1024B - Virtual size: 584B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 86KB - Virtual size: 85KB