984a1cb4666284555451f629012edc29

Sharing

Copy URL Twitter E-mail

General

Target

984a1cb4666284555451f629012edc29
Size

18.7MB
MD5

984a1cb4666284555451f629012edc29
SHA1

a72b26802dc111c94948cd7ce9f7fd8ac75e3528
SHA256

b08cc88a627987ed019f7ed5a1e6cbacaee605b18055e82d5655fd774a1bac39
SHA512

d568f8660e14bd4edf5c6c362b22caffbd693900b339c34723547cc0a08ba607af4cb80cb5c128ba8a02da3dc610b02ea5afa3f20ff4a9761f368b2dc4ea6edb
SSDEEP

393216:as4JutDVYq+xYoyIrjUxbxr6yPXsiaNKMG9W9Dqfc/GZ8eq5IDRo:k0YEyiannZqfcyFbDRo

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

984a1cb4666284555451f629012edc29
.exe windows:6 windows x86 arch:x86

Code Sign

68:3c:7e:9e:df:56:e2:a1:4f:44:ab:95:23:46:5b:58
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

01/06/2020, 00:00

Not After

01/07/2021, 23:59

Subject

CN=ROSTPAY LTD,O=ROSTPAY LTD,L=Rostov-on-Don,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

68:3c:7e:9e:df:56:e2:a1:4f:44:ab:95:23:46:5b:58
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

01/06/2020, 00:00

Not After

01/07/2021, 23:59

Subject

CN=ROSTPAY LTD,O=ROSTPAY LTD,L=Rostov-on-Don,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:7e:d6:d2:c8:9d:77:e4:4b:23:1e:9b:3f:7f:ab:d9:1a:f6:c0:81:a9:5e:b4:5f:65:32:36:79:98:81:fd:27
Signer

Actual PE Digest

b8:7e:d6:d2:c8:9d:77:e4:4b:23:1e:9b:3f:7f:ab:d9:1a:f6:c0:81:a9:5e:b4:5f:65:32:36:79:98:81:fd:27

Digest Algorithm

sha256

PE Digest Matches

true

2e:65:bd:65:42:d3:ea:30:b6:9a:e3:49:36:6d:8c:2f:b7:8e:f2:0f
Signer

Actual PE Digest

2e:65:bd:65:42:d3:ea:30:b6:9a:e3:49:36:6d:8c:2f:b7:8e:f2:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 22.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15.7MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

68:3c:7e:9e:df:56:e2:a1:4f:44:ab:95:23:46:5b:58Certificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

68:3c:7e:9e:df:56:e2:a1:4f:44:ab:95:23:46:5b:58Certificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

b8:7e:d6:d2:c8:9d:77:e4:4b:23:1e:9b:3f:7f:ab:d9:1a:f6:c0:81:a9:5e:b4:5f:65:32:36:79:98:81:fd:27Signer

2e:65:bd:65:42:d3:ea:30:b6:9a:e3:49:36:6d:8c:2f:b7:8e:f2:0fSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 22.7MB

UPX1 Size: 3.1MB - Virtual size: 3.1MB

.rsrc Size: 15.7MB - Virtual size: 15.7MB

68:3c:7e:9e:df:56:e2:a1:4f:44:ab:95:23:46:5b:58
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

68:3c:7e:9e:df:56:e2:a1:4f:44:ab:95:23:46:5b:58
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

b8:7e:d6:d2:c8:9d:77:e4:4b:23:1e:9b:3f:7f:ab:d9:1a:f6:c0:81:a9:5e:b4:5f:65:32:36:79:98:81:fd:27
Signer

2e:65:bd:65:42:d3:ea:30:b6:9a:e3:49:36:6d:8c:2f:b7:8e:f2:0f
Signer

UPX0
Size: - Virtual size: 22.7MB

UPX1
Size: 3.1MB - Virtual size: 3.1MB

.rsrc
Size: 15.7MB - Virtual size: 15.7MB