4a6e8b6b8530d10f9ec8d5f78d51d6b8

Sharing

Copy URL

Twitter E-mail

General

Target

4a6e8b6b8530d10f9ec8d5f78d51d6b8
Size

1.2MB
MD5

4a6e8b6b8530d10f9ec8d5f78d51d6b8
SHA1

6c41896c75656af0ace63fedb6468b666a942679
SHA256

39abf612a2e3b328a0f2912c51807dcfc9ee2077e037b03d277e709dca0fc959
SHA512

ea049d2e516de6730630a88d980468b1c6e22fe323cb641b654dd6f5b616c86d5e80f6c3ff9955608f8ca56ecb5f34592c9cfd379ea864f2a156986633f452d6
SSDEEP

24576:PagfE+/XN/OB/76pE7Gi+sc9GnoJOQDpWnoypgB+3E1zVaR3+GoltYefYYugxl:/fx9k/7SE7Gia8noMQD0oypgYF33oltR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

4a6e8b6b8530d10f9ec8d5f78d51d6b8
.exe windows:4 windows x86 arch:x86

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:ae:0f
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11-10-2004 05:29

Not After

08-10-2005 07:51

Subject

CN=DNAML PTY LTD,OU=Secure Application Development,O=DNAML PTY LTD,L=Sydney,ST=NSW,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4a:7e:60:62:39:cf:9a:96:6a:ea:93:ce:9c:dc:40:72:a2:ba:c3:88
Signer

Actual PE Digest

4a:7e:60:62:39:cf:9a:96:6a:ea:93:ce:9c:dc:40:72:a2:ba:c3:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3e:ae:0fCertificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

4a:7e:60:62:39:cf:9a:96:6a:ea:93:ce:9c:dc:40:72:a2:ba:c3:88Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.6MB

UPX1 Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 3KB - Virtual size: 4KB

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3e:ae:0f
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

4a:7e:60:62:39:cf:9a:96:6a:ea:93:ce:9c:dc:40:72:a2:ba:c3:88
Signer

UPX0
Size: - Virtual size: 2.6MB

UPX1
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 3KB - Virtual size: 4KB