winexp-x64[.]zip

Resubmissions

14/02/2024, 15:41

240214-s49w4sfe89 8

14/02/2024, 15:30

240214-sxga8aec9x 7

Sharing

Copy URL Twitter E-mail

General

Target

winexp-x64.zip
Size

153KB
MD5

e479178e79d9aed91753f37d31f61051
SHA1

27d9183c17022087783fdac0f570bdbc9b1d4ccc
SHA256

9df57e7deab0aead910868225512c9ba6489290f588cdd87476014ad166ee998
SHA512

b760269f247ddb4d5e8a7cc81a74e73efd226d0c7ca19b97a695f0f015c1ff13981d8e5426b5c1c39806853f419d483b922334d1a3bc7d69e4da78bf94c8ebcf
SSDEEP

3072:9aaMsGU3QByR89cRPigNWuXad0mGALh9A4G4VkN3lox24aaMsGNzJUcTIFA8bWdC:9hGSQB26cJigNDX29DBkOphG7Uccy8bL

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/data/winexp.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Psapi.dll
unpack001/data/Psapi.dll
unpack002/out.upx

Files

winexp-x64.zip
.zip
Psapi.dll
.dll windows:5 windows x86 arch:x86

cc0703efce46b4b2d90e7279fd0456d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

NtAllocateVirtualMemory
RtlNtStatusToDosError
atoi
RtlUnwind
_stricmp
_chkstk
NtStopProfile
sprintf
RtlMultiByteToUnicodeN
DbgPrint
RtlUnicodeToOemN
NtCreateProfile
NtSetIntervalProfile
NtStartProfile
RtlAdjustPrivilege
NtWriteFile
NtSetInformationProcess
NtQueryInformationProcess
NtQueryVirtualMemory
NtQuerySystemInformation

kernel32

MultiByteToWideChar
GetProcessWorkingSetSize
WideCharToMultiByte
ReadProcessMemory
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
CreateFileA
CloseHandle
DisableThreadLibraryCalls
HeapAlloc
lstrlenA
SetLastError
LocalFree
LocalAlloc
SetProcessWorkingSetSize
GetProcessHeap
GetSystemInfo
lstrcpyA

imagehlp

SymLoadModule
SymGetModuleInfo
SymGetSymFromAddr
SymUnloadModule
SymSetOptions
SymInitialize
SymGetSearchPath

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
QueryWorkingSet

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/Psapi.dll
.dll windows:5 windows x86 arch:x86

cc0703efce46b4b2d90e7279fd0456d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

NtAllocateVirtualMemory
RtlNtStatusToDosError
atoi
RtlUnwind
_stricmp
_chkstk
NtStopProfile
sprintf
RtlMultiByteToUnicodeN
DbgPrint
RtlUnicodeToOemN
NtCreateProfile
NtSetIntervalProfile
NtStartProfile
RtlAdjustPrivilege
NtWriteFile
NtSetInformationProcess
NtQueryInformationProcess
NtQueryVirtualMemory
NtQuerySystemInformation

kernel32

MultiByteToWideChar
GetProcessWorkingSetSize
WideCharToMultiByte
ReadProcessMemory
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
CreateFileA
CloseHandle
DisableThreadLibraryCalls
HeapAlloc
lstrlenA
SetLastError
LocalFree
LocalAlloc
SetProcessWorkingSetSize
GetProcessHeap
GetSystemInfo
lstrcpyA

imagehlp

SymLoadModule
SymGetModuleInfo
SymGetSymFromAddr
SymUnloadModule
SymSetOptions
SymInitialize
SymGetSearchPath

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
QueryWorkingSet

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/dotnet.dll
.vbs
data/winexp.exe
.exe windows:4 windows x86 arch:x86

Code Sign

7b:2c:9b:d3:16:80:32:99
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

12/02/2016, 17:39

Not After

12/02/2041, 17:39

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:71:bf:d4:0b:15:02:0a:57:fa:d2:0e:1a:50:d3:a7
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

14/09/2023, 19:00

Not After

13/09/2024, 19:00

Subject

CN=Raecomm Services Ltd,O=Raecomm Services Ltd,L=Rowlands Gill,ST=England,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ff:87:e4:ee:f4:56:2e:32:54:ce:4f:61:7d:e8:c2:32:a7:e8:7d:7c:b0:9b:ac:ec:98:b9:7f:ba:0d:81:2a:c2
Signer

Actual PE Digest

ff:87:e4:ee:f4:56:2e:32:54:ce:4f:61:7d:e8:c2:32:a7:e8:7d:7c:b0:9b:ac:ec:98:b9:7f:ba:0d:81:2a:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
winexp.chm
.chm
winexp.exe
.exe windows:4 windows x64 arch:x64

Code Sign

7b:2c:9b:d3:16:80:32:99
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

12/02/2016, 17:39

Not After

12/02/2041, 17:39

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:71:bf:d4:0b:15:02:0a:57:fa:d2:0e:1a:50:d3:a7
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

14/09/2023, 19:00

Not After

13/09/2024, 19:00

Subject

CN=Raecomm Services Ltd,O=Raecomm Services Ltd,L=Rowlands Gill,ST=England,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:a5:a6:e5:ab:4a:a2:19:c6:74:e6:17:25:55:74:73:4a:60:d3:58:85:38:af:3b:a4:b1:01:fc:10:d6:42:a6
Signer

Actual PE Digest

d4:a5:a6:e5:ab:4a:a2:19:c6:74:e6:17:25:55:74:73:4a:60:d3:58:85:38:af:3b:a4:b1:01:fc:10:d6:42:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\source\repos\Swing\Swing\obj\Debug\winexp.pdb

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

cc0703efce46b4b2d90e7279fd0456d8

Headers

File Characteristics

Imports

ntdll

kernel32

imagehlp

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 1024B - Virtual size: 830B

cc0703efce46b4b2d90e7279fd0456d8

Headers

File Characteristics

Imports

ntdll

kernel32

imagehlp

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 1024B - Virtual size: 830B

Code Sign

7b:2c:9b:d3:16:80:32:99Certificate

Key Usages

40:71:bf:d4:0b:15:02:0a:57:fa:d2:0e:1a:50:d3:a7Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

ff:87:e4:ee:f4:56:2e:32:54:ce:4f:61:7d:e8:c2:32:a7:e8:7d:7c:b0:9b:ac:ec:98:b9:7f:ba:0d:81:2a:c2Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 68KB

UPX1 Size: 13KB - Virtual size: 16KB

.rsrc Size: 37KB - Virtual size: 40KB

Headers

File Characteristics

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 51KB - Virtual size: 50KB

Code Sign

7b:2c:9b:d3:16:80:32:99Certificate

Key Usages

40:71:bf:d4:0b:15:02:0a:57:fa:d2:0e:1a:50:d3:a7Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

d4:a5:a6:e5:ab:4a:a2:19:c6:74:e6:17:25:55:74:73:4a:60:d3:58:85:38:af:3b:a4:b1:01:fc:10:d6:42:a6Signer

Headers

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 1024B - Virtual size: 830B

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 1024B - Virtual size: 830B

7b:2c:9b:d3:16:80:32:99
Certificate

40:71:bf:d4:0b:15:02:0a:57:fa:d2:0e:1a:50:d3:a7
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

ff:87:e4:ee:f4:56:2e:32:54:ce:4f:61:7d:e8:c2:32:a7:e8:7d:7c:b0:9b:ac:ec:98:b9:7f:ba:0d:81:2a:c2
Signer

UPX0
Size: - Virtual size: 68KB

UPX1
Size: 13KB - Virtual size: 16KB

.rsrc
Size: 37KB - Virtual size: 40KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 51KB - Virtual size: 50KB

7b:2c:9b:d3:16:80:32:99
Certificate

40:71:bf:d4:0b:15:02:0a:57:fa:d2:0e:1a:50:d3:a7
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

d4:a5:a6:e5:ab:4a:a2:19:c6:74:e6:17:25:55:74:73:4a:60:d3:58:85:38:af:3b:a4:b1:01:fc:10:d6:42:a6
Signer

.text
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 5KB