1ccd9aab24e982b66755b058bc091e67

Sharing

Copy URL

Twitter E-mail

General

Target

1ccd9aab24e982b66755b058bc091e67
Size

959KB
MD5

1ccd9aab24e982b66755b058bc091e67
SHA1

8b0e53b68c4933a072d3ee70b24ae6377d2c6064
SHA256

3a5960ce73317e788b03ccc176d3df4163d482c5d54defc73cfebd56233fbbcd
SHA512

7de698bdbc77f84688d9a47e925c38c3bfdee2c13205b5df28e94e087cd439ca4234e72966a5d55913f8874407252faad3382311e4d195d009c6b0a2d219c88a
SSDEEP

24576:ys1aeQvXtLrWq8qQs6SoQbsa0OD9x8nRfaEj5fyB:ys1MtLrz8qQkd0W9+nBbc

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

1ccd9aab24e982b66755b058bc091e67
.dll windows:5 windows x86 arch:x86

Code Sign

4a:f7:4d:10:ce:1d:a1:7e:c9:80:9e:67:d8:1c:37:56:14:a1:f0:ff
Certificate

Issuer

CN=PROGUARD,OU=PROGUARD,O=PROGUARD,L=macaé,ST=Rio de janeiro,C=BR,1.2.840.113549.1.9.1=#0c1150524f4755415244404c4956452e434f4d

Not Before

26-02-2021 18:38

Not After

26-02-2022 18:38

Subject

CN=PROGUARD,OU=PROGUARD,O=PROGUARD,L=macaé,ST=Rio de janeiro,C=BR,1.2.840.113549.1.9.1=#0c1150524f4755415244404c4956452e434f4d

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4a:f7:4d:10:ce:1d:a1:7e:c9:80:9e:67:d8:1c:37:56:14:a1:f0:ff
Certificate

Issuer

CN=PROGUARD,OU=PROGUARD,O=PROGUARD,L=macaé,ST=Rio de janeiro,C=BR,1.2.840.113549.1.9.1=#0c1150524f4755415244404c4956452e434f4d

Not Before

26-02-2021 18:38

Not After

26-02-2022 18:38

Subject

CN=PROGUARD,OU=PROGUARD,O=PROGUARD,L=macaé,ST=Rio de janeiro,C=BR,1.2.840.113549.1.9.1=#0c1150524f4755415244404c4956452e434f4d

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:4a:e4:d7:86:0c:67:a2:48:80:49:fd:30:90:33:f6:5e:99:32:dd:22:e6:e4:84:2f:45:a7:3d:4b:f8:7d:33
Signer

Actual PE Digest

1e:4a:e4:d7:86:0c:67:a2:48:80:49:fd:30:90:33:f6:5e:99:32:dd:22:e6:e4:84:2f:45:a7:3d:4b:f8:7d:33

Digest Algorithm

sha256

PE Digest Matches

true

11:77:52:34:ed:8f:81:d2:6c:c5:d3:d1:ec:25:86:d0:0b:64:b1:1d
Signer

Actual PE Digest

11:77:52:34:ed:8f:81:d2:6c:c5:d3:d1:ec:25:86:d0:0b:64:b1:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
felipekzilio

Sections

UPX0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 942KB - Virtual size: 944KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 26KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 173B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

4a:f7:4d:10:ce:1d:a1:7e:c9:80:9e:67:d8:1c:37:56:14:a1:f0:ffCertificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

4a:f7:4d:10:ce:1d:a1:7e:c9:80:9e:67:d8:1c:37:56:14:a1:f0:ffCertificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

1e:4a:e4:d7:86:0c:67:a2:48:80:49:fd:30:90:33:f6:5e:99:32:dd:22:e6:e4:84:2f:45:a7:3d:4b:f8:7d:33Signer

11:77:52:34:ed:8f:81:d2:6c:c5:d3:d1:ec:25:86:d0:0b:64:b1:1dSigner

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 2.3MB

UPX1 Size: 942KB - Virtual size: 944KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.itext Size: 9KB - Virtual size: 8KB

.data Size: 51KB - Virtual size: 50KB

.bss Size: - Virtual size: 26KB

.idata Size: 15KB - Virtual size: 14KB

.didata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 173B

.rdata Size: 512B - Virtual size: 68B

.reloc Size: 241KB - Virtual size: 241KB

.rsrc Size: 120KB - Virtual size: 120KB

4a:f7:4d:10:ce:1d:a1:7e:c9:80:9e:67:d8:1c:37:56:14:a1:f0:ff
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

4a:f7:4d:10:ce:1d:a1:7e:c9:80:9e:67:d8:1c:37:56:14:a1:f0:ff
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

1e:4a:e4:d7:86:0c:67:a2:48:80:49:fd:30:90:33:f6:5e:99:32:dd:22:e6:e4:84:2f:45:a7:3d:4b:f8:7d:33
Signer

11:77:52:34:ed:8f:81:d2:6c:c5:d3:d1:ec:25:86:d0:0b:64:b1:1d
Signer

UPX0
Size: - Virtual size: 2.3MB

UPX1
Size: 942KB - Virtual size: 944KB

.rsrc
Size: 4KB - Virtual size: 8KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.itext
Size: 9KB - Virtual size: 8KB

.data
Size: 51KB - Virtual size: 50KB

.bss
Size: - Virtual size: 26KB

.idata
Size: 15KB - Virtual size: 14KB

.didata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 173B

.rdata
Size: 512B - Virtual size: 68B

.reloc
Size: 241KB - Virtual size: 241KB

.rsrc
Size: 120KB - Virtual size: 120KB