7d21950885759ff0368d2adefd76cd7105e5edcd3f08e4888e4bf3f0f99e89b1

Sharing

Copy URL Twitter E-mail

General

Target

7d21950885759ff0368d2adefd76cd7105e5edcd3f08e4888e4bf3f0f99e89b1
Size

2.8MB
MD5

161b03cecd182258e15b5362ff4cd977
SHA1

0462ba9bdbe5c1055d60316efd0f4517cab8a688
SHA256

7d21950885759ff0368d2adefd76cd7105e5edcd3f08e4888e4bf3f0f99e89b1
SHA512

2c7552874546482e70d8c663110de17014df42160a8592398af9285938a256bbc9726bd08f65e2ed3c2fa27d4d79875363fdd65b2a39582a4606eb4bf7698581
SSDEEP

49152:H9Q2xpjz3T1rJXtyLt092TTHQH/bNoHCatnJMgcx1AT7Bo35CQoWDL8Y2wd2A:H7t5BGT4uCaV+gcx1An65CQovwH

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

7d21950885759ff0368d2adefd76cd7105e5edcd3f08e4888e4bf3f0f99e89b1
.exe windows:4 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

57:d9:42:4f:9e:20:31:ef:15:81:18:0b:93:61:98:18
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

23/04/2015, 08:14

Not After

23/04/2016, 09:14

Subject

CN=上海磊通投资咨询有限公司,O=上海磊通投资咨询有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ec:8b:b0:83:2e:b6:09:d5:92:dc:14:97:9f:cb:61:0d:15:c5:02:51
Signer

Actual PE Digest

ec:8b:b0:83:2e:b6:09:d5:92:dc:14:97:9f:cb:61:0d:15:c5:02:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 750KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 22KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bbsv
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bbsv
Size: 133KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 121KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bbsv
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bbsv
Size: 121KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Silvana
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test
Size: 371KB - Virtual size: 932KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

57:d9:42:4f:9e:20:31:ef:15:81:18:0b:93:61:98:18Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

ec:8b:b0:83:2e:b6:09:d5:92:dc:14:97:9f:cb:61:0d:15:c5:02:51Signer

Headers

File Characteristics

Sections

CODE Size: 750KB - Virtual size: 2.2MB

DATA Size: 22KB - Virtual size: 48KB

BSS Size: - Virtual size: 1.2MB

.idata Size: 12KB - Virtual size: 16KB

.bbsv Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.bbsv Size: 133KB - Virtual size: 144KB

.rsrc Size: 121KB - Virtual size: 1.1MB

.bbsv Size: 1.3MB - Virtual size: 1.3MB

.bbsv Size: 121KB - Virtual size: 128KB

.reloc Size: - Virtual size: 4KB

.Silvana Size: 512B - Virtual size: 4KB

.test Size: 371KB - Virtual size: 932KB

.aspack Size: 5KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

57:d9:42:4f:9e:20:31:ef:15:81:18:0b:93:61:98:18
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

ec:8b:b0:83:2e:b6:09:d5:92:dc:14:97:9f:cb:61:0d:15:c5:02:51
Signer

CODE
Size: 750KB - Virtual size: 2.2MB

DATA
Size: 22KB - Virtual size: 48KB

BSS
Size: - Virtual size: 1.2MB

.idata
Size: 12KB - Virtual size: 16KB

.bbsv
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.bbsv
Size: 133KB - Virtual size: 144KB

.rsrc
Size: 121KB - Virtual size: 1.1MB

.bbsv
Size: 1.3MB - Virtual size: 1.3MB

.bbsv
Size: 121KB - Virtual size: 128KB

.reloc
Size: - Virtual size: 4KB

.Silvana
Size: 512B - Virtual size: 4KB

.test
Size: 371KB - Virtual size: 932KB

.aspack
Size: 5KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB