formula[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

formula.exe
Size

5.4MB
MD5

f2c5a1f8aeebe0faae4feadb69d31aa7
SHA1

8cc331a64dafbbd5e8fa326cdfc4bf6175816752
SHA256

22a82fc34d9b412347e2f7110cd634dcb6df16f654f22190789ce6385dc155f5
SHA512

8cbe34128a0268a1655b2fb64ca2fde703c4cd08f6cae5d39832824459fbdef69f3fb0d1fdd268133e9e69324576913f621a15bff5e93506b7ceefa3ebd252e3
SSDEEP

98304:HO13W5JDGXMn0ftr2NMf8iIn2jV1q2apZ/mOwsWh+WRHZkpVtq9Ms:cg9GVtr2NvPnUba3bWh+OQVAv

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

formula.exe
.exe windows:5 windows x86 arch:x86

Code Sign

3a:d6:6e:8b:2d:4c:a0:2f:77:96:8f:19:b8:f2:1a:99
Certificate

Issuer

CN=thawte SHA256 Code Signing CA - G2,O=thawte\, Inc.,C=US

Not Before

11-07-2018 00:00

Not After

11-07-2019 23:59

Subject

CN=PJSC Sovcombank,OU=DIT,O=PJSC Sovcombank,L=Kostroma,ST=Kostromskaya obl,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:f3:cc:63:cf:04:30:4d:47:c3:b5:87:04:9f:a8:07
Certificate

Issuer

CN=thawte Primary Root CA - G3,OU=Certification Services Division+OU=(c) 2008 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

22-07-2014 00:00

Not After

21-07-2024 23:59

Subject

CN=thawte SHA256 Code Signing CA - G2,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:bb:65:c7:aa:3c:19:96:97:8f:e5:4e:32:0e:fa:b2:01:bd:1d:17
Signer

Actual PE Digest

b6:bb:65:c7:aa:3c:19:96:97:8f:e5:4e:32:0e:fa:b2:01:bd:1d:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
madTraceProcess

Sections

.text
Size: 4.3MB - Virtual size: 16.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 15KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 53KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 558KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 433KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

3a:d6:6e:8b:2d:4c:a0:2f:77:96:8f:19:b8:f2:1a:99Certificate

Extended Key Usages

Key Usages

0b:f3:cc:63:cf:04:30:4d:47:c3:b5:87:04:9f:a8:07Certificate

Extended Key Usages

Key Usages

b6:bb:65:c7:aa:3c:19:96:97:8f:e5:4e:32:0e:fa:b2:01:bd:1d:17Signer

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 16.2MB

.itext Size: 15KB - Virtual size: 40KB

.data Size: 53KB - Virtual size: 128KB

.bss Size: - Virtual size: 101KB

.idata Size: 6KB - Virtual size: 24KB

.didata Size: 1024B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.tls Size: - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: 558KB - Virtual size: 1.6MB

.rsrc Size: 433KB - Virtual size: 2.3MB

.aspack Size: 11KB - Virtual size: 12KB

.adata Size: - Virtual size: 4KB

3a:d6:6e:8b:2d:4c:a0:2f:77:96:8f:19:b8:f2:1a:99
Certificate

0b:f3:cc:63:cf:04:30:4d:47:c3:b5:87:04:9f:a8:07
Certificate

b6:bb:65:c7:aa:3c:19:96:97:8f:e5:4e:32:0e:fa:b2:01:bd:1d:17
Signer

.text
Size: 4.3MB - Virtual size: 16.2MB

.itext
Size: 15KB - Virtual size: 40KB

.data
Size: 53KB - Virtual size: 128KB

.bss
Size: - Virtual size: 101KB

.idata
Size: 6KB - Virtual size: 24KB

.didata
Size: 1024B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.tls
Size: - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: 558KB - Virtual size: 1.6MB

.rsrc
Size: 433KB - Virtual size: 2.3MB

.aspack
Size: 11KB - Virtual size: 12KB

.adata
Size: - Virtual size: 4KB