5af37af053c07978cfa6019f0e8ff3e0

Sharing

Copy URL

Twitter E-mail

General

Target

5af37af053c07978cfa6019f0e8ff3e0
Size

882KB
MD5

5af37af053c07978cfa6019f0e8ff3e0
SHA1

60d90000472be16f90458656ca4c6f6d66c65328
SHA256

212131343d90a37bcd95674c3acf914f36a6816c7d6b964087b6b5b9c3ad615c
SHA512

a4c30ce1b5b4ce0e2d62f4d43bd2244d4be10dae04729022ab59dc65283660078a34d9d8c08eb961cd50af1ab7af0fe4857c37bbe88de6a56b98c2e6ac2304ef
SSDEEP

24576:qWqMqYV0bVZFSq+RJqwPHEPw7isSnP+eUJLGbXUY8DgsO/:qWj0BZFSq+imEPw7isSLUFGbSgsO/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

5af37af053c07978cfa6019f0e8ff3e0
.exe windows:5 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

24-10-2007 22:01

Not After

24-10-2017 22:01

Subject

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:aa
Certificate

Issuer

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

26-11-2011 00:44

Not After

26-11-2013 23:03

Subject

CN=Liao Guobo,L=Shenzhen,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c14737570706f727440686f706f736f66742e636f6d,2.5.4.13=#13173537353635372d7055374f655739464b73796832397444

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d6:97:fd:7f:87:8f:73:b8:03:40:32:6d:81:f7:48:b5:16:13:e4:bf
Signer

Actual PE Digest

d6:97:fd:7f:87:8f:73:b8:03:40:32:6d:81:f7:48:b5:16:13:e4:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 798KB - Virtual size: 800KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

24Certificate

Key Usages

04:aaCertificate

Extended Key Usages

Key Usages

d6:97:fd:7f:87:8f:73:b8:03:40:32:6d:81:f7:48:b5:16:13:e4:bfSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.0MB

UPX1 Size: 798KB - Virtual size: 800KB

.rsrc Size: 77KB - Virtual size: 80KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

24
Certificate

04:aa
Certificate

d6:97:fd:7f:87:8f:73:b8:03:40:32:6d:81:f7:48:b5:16:13:e4:bf
Signer

UPX0
Size: - Virtual size: 2.0MB

UPX1
Size: 798KB - Virtual size: 800KB

.rsrc
Size: 77KB - Virtual size: 80KB