9c9f9d0bd8ca8e9174f13dcaa44f2613

General

Target
9c9f9d0bd8ca8e9174f13dcaa44f2613
Size 87KB
Sample240215-b5q2ysdg21
SHA256 8a214c99a14ecc59728c3e0bac8f1a71b5a42b02948fab7aeebfa2a6a53875cd
MD5 9c9f9d0bd8ca8e9174f13dcaa44f2613
SHA1 20329a45925d01be1b5540c284fd6cef6a529737
SHA512 5d66b2e34f8268f035f4fdc89e0d6cc3186d67359673c0ccd2d4cb7b88e2567b1603e1f34dd12ffce0ce7acebfefb8a2f22c1bbccf995ccfc8195b97cb95cdc4
SSDEEP 1536:y/sfXh6Z1fFyoNCoGEvBlfXyoBncIe+E9WQKzuHkN1MAarP0nnRshPdBteJzJnvw:ykfXh6Z1fFyhEp1XyoBncIeeSHqnG0nm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

9c9f9d0bd8ca8e9174f13dcaa44f2613

.exe 87KB
out.upx

.exe 240KB

9c9f9d0bd8ca8e9174f13dcaa44f2613

SHA256 8a214c99a14ecc59728c3e0bac8f1a71b5a42b02948fab7aeebfa2a6a53875cd
MD5 9c9f9d0bd8ca8e9174f13dcaa44f2613
SHA1 20329a45925d01be1b5540c284fd6cef6a529737
SHA512 5d66b2e34f8268f035f4fdc89e0d6cc3186d67359673c0ccd2d4cb7b88e2567b1603e1f34dd12ffce0ce7acebfefb8a2f22c1bbccf995ccfc8195b97cb95cdc4
SSDEEP 1536:y/sfXh6Z1fFyoNCoGEvBlfXyoBncIe+E9WQKzuHkN1MAarP0nnRshPdBteJzJnvw:ykfXh6Z1fFyhEp1XyoBncIeeSHqnG0nm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

01

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

33:c9:4b:e6:07:a8:fc:a7:65:27:50:3b:c6:f9:94:0a

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 17, 2009 - Dec 17, 2010

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

0a

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

0

Major OS version

4

Entry point

252320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 09be4a72b56d31c224bb2abd04bdad6ce74f88f49091ea2da89787fcb0750ee5
MD5 1ff74f0ffbabfaf63234656c2904b450
SHA1 e9f9dcb170278dd701205cc04e08987b14465bdc
SHA512 a2ffc075af2afd356f074e2062015157bfcc4383fe7bdb01bd61bb623c053f0fa8e820933d06abe6e4421b18d1acdd6677716a3d64f1a373c830a19bba4882c2
SSDEEP 3072:BgK3eVViMoOGvPNZJppnNJunqwOruZp0k8wNA9LcEyzxgjBin88FtOAVZnr8CYna:BruyVnCbhA0zxw4OAVJ8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17789

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

9c9f9d0bd8ca8e9174f13dcaa44f2613

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

9c9f9d0bd8ca8e9174f13dcaa44f2613

PE Signature issue

generic

out.upx

generic