585d54c78dc614c20cf4f04e85860e04e55383205486fb4edf1485cab93af22e

Sharing

Copy URL Twitter E-mail

General

Target

585d54c78dc614c20cf4f04e85860e04e55383205486fb4edf1485cab93af22e
Size

1.1MB
MD5

43e4f98de15760d835c85b9812ef463c
SHA1

d1ebda0cddc922b5a4a99f5c5ce8d7caf19dcd57
SHA256

585d54c78dc614c20cf4f04e85860e04e55383205486fb4edf1485cab93af22e
SHA512

6cc68234d5f38d7d911051028c1bb1fdc92f69b8dd570cc9695edd04e9c830ebb65a43ede20bd79355bd8193f94bd4ba22297a6491ed8cbddfbfabaeb3706d69
SSDEEP

12288:7KUzJ6lDa+WY/2wN4E4wctdizmDF8wZkvotKXH5VIa2Lh5+tivoex4MiVwhvjV06:7WlzWY+vaEBa70Nt5Nd3k6CAdOkJ7

Score

10^/10

Malware Config

Signatures

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ConfuserEx

Files

585d54c78dc614c20cf4f04e85860e04e55383205486fb4edf1485cab93af22e
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:00:f5:eb:e0:39:43
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

14/10/2007, 22:01

Not After

14/10/2022, 22:01

Subject

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:65:f1:32:68:bf:a1
Certificate

Issuer

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

08/02/2015, 14:15

Not After

08/02/2017, 09:22

Subject

CN=Philipp Maihart,L=Kleinhadersdorf,ST=Niederosterreich,C=AT,1.2.840.113549.1.9.1=#0c106f666669636540706d6c6162732e6174

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

79:9c:4e:52:11:c3:25:42:67:6c:b5:78:c7:8e:64:8b:c3:1b:06:c2
Signer

Actual PE Digest

79:9c:4e:52:11:c3:25:42:67:6c:b5:78:c7:8e:64:8b:c3:1b:06:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

R}R
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 938KB - Virtual size: 938KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

10:00:f5:eb:e0:39:43Certificate

Key Usages

10:65:f1:32:68:bf:a1Certificate

Extended Key Usages

Key Usages

79:9c:4e:52:11:c3:25:42:67:6c:b5:78:c7:8e:64:8b:c3:1b:06:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

R}R Size: 106KB - Virtual size: 106KB

.text Size: 938KB - Virtual size: 938KB

.rsrc Size: 83KB - Virtual size: 83KB

.reloc Size: 512B - Virtual size: 12B

Size: 512B - Virtual size: 144B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:00:f5:eb:e0:39:43
Certificate

10:65:f1:32:68:bf:a1
Certificate

79:9c:4e:52:11:c3:25:42:67:6c:b5:78:c7:8e:64:8b:c3:1b:06:c2
Signer

R}R
Size: 106KB - Virtual size: 106KB

.text
Size: 938KB - Virtual size: 938KB

.rsrc
Size: 83KB - Virtual size: 83KB

.reloc
Size: 512B - Virtual size: 12B