a3f9e7787a1b07383b16a9deba1e2e34620eb2d5319fb612146a63fcc8106ab5[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

a3f9e7787a1b07383b16a9deba1e2e34620eb2d5319fb612146a63fcc8106ab5.exe.zip
Size

5.0MB
MD5

cc94d708541c989b0221289c5331e0a5
SHA1

24a97d483a59359455dfab5639b65b6d04f44fae
SHA256

6905b9c20de977e61d11627c20461efb4ad30991d96225b5375d19ebe06101ae
SHA512

e064306f6a8f2a1592c39072f5eebbc76c9216e81f7226486e11ac30906100d127e5e46453d59bcb9cbcc29f96b68709f2a443ef3e88b6d90b2790f1723743c2
SSDEEP

98304:RyP/qEUrd/NQIgSHMPmfouAK8EmbfZoQhcw9QEQ8l:RlEUrd/N6SsPqos8EmdhhcSQEQe

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/a3f9e7787a1b07383b16a9deba1e2e34620eb2d5319fb612146a63fcc8106ab5.exe	upx

Files

a3f9e7787a1b07383b16a9deba1e2e34620eb2d5319fb612146a63fcc8106ab5.exe.zip
.zip

Password: infected
a3f9e7787a1b07383b16a9deba1e2e34620eb2d5319fb612146a63fcc8106ab5.exe
.exe windows:5 windows x86 arch:x86

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:7a:d3:d6:c1:3c:25:e9:e5:c7:d5:18:d0:5c:53:1d
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10/04/2013, 00:00

Not After

10/04/2015, 23:59

Subject

CN=Macecraft Software,O=Macecraft Software,POSTALCODE=20100,STREET=Aninkaistenkatu 5 B 21,L=Turku,ST=Satakunta,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:a5:8c:08:93:b1:43:88:5f:0f:58:19:46:52:7f:8d:10:3a:11:92
Signer

Actual PE Digest

9e:a5:8c:08:93:b1:43:88:5f:0f:58:19:46:52:7f:8d:10:3a:11:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 416KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 365KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

f7:7a:d3:d6:c1:3c:25:e9:e5:c7:d5:18:d0:5c:53:1dCertificate

Extended Key Usages

Key Usages

9e:a5:8c:08:93:b1:43:88:5f:0f:58:19:46:52:7f:8d:10:3a:11:92Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 416KB

UPX1 Size: 26KB - Virtual size: 28KB

.rsrc Size: 365KB - Virtual size: 368KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

f7:7a:d3:d6:c1:3c:25:e9:e5:c7:d5:18:d0:5c:53:1d
Certificate

9e:a5:8c:08:93:b1:43:88:5f:0f:58:19:46:52:7f:8d:10:3a:11:92
Signer

UPX0
Size: - Virtual size: 416KB

UPX1
Size: 26KB - Virtual size: 28KB

.rsrc
Size: 365KB - Virtual size: 368KB