449846f15f0ae204e369fa92de7d5b58

Sharing

Copy URL

Twitter E-mail

General

Target

449846f15f0ae204e369fa92de7d5b58
Size

264KB
MD5

449846f15f0ae204e369fa92de7d5b58
SHA1

766db4acd49b1238b86d3d3308edc57a35bfa44f
SHA256

5b4a5264570983efcabff11977f53f6e9ceba31405e1c3d8f23d035d1d34612b
SHA512

93de3eb66d79d78d85df1898a2a6ec358a44ec9f294a27c7c1726108e6d46e1ac07c9e4f63a3cddc3efc391584de5d880ba715b8b35c641de212a477675182d6
SSDEEP

6144:brZbQ4Ro9mM0wHb88Ss0LJB9t7q+H6XBlkv4tDC:/y50w4P71BPxHX+W

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

449846f15f0ae204e369fa92de7d5b58
.exe windows:5 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:ec:36:12:43:5e:1d:19:ca:35:db:6f:dd:08:6b:1a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23-04-2010 00:00

Not After

22-06-2011 23:59

Subject

CN=Qingdao Loogoo InfoTech Co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qingdao Loogoo InfoTech Co.\,ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:11:c6:be:42:16:a6:59:3a:c6:94:e0:49:45:f1:c9:ab:b7:d0:01
Signer

Actual PE Digest

3a:11:c6:be:42:16:a6:59:3a:c6:94:e0:49:45:f1:c9:ab:b7:d0:01

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

70:ec:36:12:43:5e:1d:19:ca:35:db:6f:dd:08:6b:1aCertificate

Extended Key Usages

Key Usages

3a:11:c6:be:42:16:a6:59:3a:c6:94:e0:49:45:f1:c9:ab:b7:d0:01Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 148KB

UPX1 Size: 45KB - Virtual size: 48KB

.rsrc Size: 60KB - Virtual size: 64KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 64KB - Virtual size: 63KB

.reloc Size: 9KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

70:ec:36:12:43:5e:1d:19:ca:35:db:6f:dd:08:6b:1a
Certificate

3a:11:c6:be:42:16:a6:59:3a:c6:94:e0:49:45:f1:c9:ab:b7:d0:01
Signer

UPX0
Size: - Virtual size: 148KB

UPX1
Size: 45KB - Virtual size: 48KB

.rsrc
Size: 60KB - Virtual size: 64KB

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 64KB - Virtual size: 63KB

.reloc
Size: 9KB - Virtual size: 9KB