2b1b2e2b385c22f12d16b626f6ceeb713eff7f152c6225ee9bc49d8609a6c7d9[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2b1b2e2b385c22f12d16b626f6ceeb713eff7f152c6225ee9bc49d8609a6c7d9.exe
Size

128KB
MD5

13f784b718e0d45057b628f504a11235
SHA1

9f06af54f5ae22e32811d85344468bed4bde28ab
SHA256

2b1b2e2b385c22f12d16b626f6ceeb713eff7f152c6225ee9bc49d8609a6c7d9
SHA512

3e5e6d2bf9d40a90baf55f580289512b6b95f8aa5c9842f7f925a8faaae374e61b738ea01d3bcfd7b30427226d8d4291947822da2134b33f74a9eea7f20fb0e7
SSDEEP

1536:v8OJN+kiHVKeBEOAe9zRozT9CmGMlwLl0x8w8qW0KMhXO+kKDZdpXmdAdklV/Mgs:vZJN+FDXAPR7ILl0+50u+kKVzdCf/zx+

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

2b1b2e2b385c22f12d16b626f6ceeb713eff7f152c6225ee9bc49d8609a6c7d9.exe
.exe windows:5 windows x64 arch:x64

Code Sign

33:00:00:00:25:3a:27:38:69:0a:34:51:c1:00:00:00:00:00:25
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-09-2018 21:30

Not After

06-09-2019 21:30

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-10-2014 20:31

Not After

15-10-2029 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:09:54:07:67:aa:41:e7:48:a8:8f:b3:c6:73:1b:54:de:6e:05:fd:76:1a:51:2a:30:26:fc:d6:6c:78:9e:c7
Signer

Actual PE Digest

9c:09:54:07:67:aa:41:e7:48:a8:8f:b3:c6:73:1b:54:de:6e:05:fd:76:1a:51:2a:30:26:fc:d6:6c:78:9e:c7

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:00:25:3a:27:38:69:0a:34:51:c1:00:00:00:00:00:25Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

9c:09:54:07:67:aa:41:e7:48:a8:8f:b3:c6:73:1b:54:de:6e:05:fd:76:1a:51:2a:30:26:fc:d6:6c:78:9e:c7Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 148KB

UPX1 Size: 19KB - Virtual size: 20KB

.rsrc Size: 99KB - Virtual size: 100KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 8KB

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 944B

.rsrc Size: 99KB - Virtual size: 98KB

33:00:00:00:25:3a:27:38:69:0a:34:51:c1:00:00:00:00:00:25
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

9c:09:54:07:67:aa:41:e7:48:a8:8f:b3:c6:73:1b:54:de:6e:05:fd:76:1a:51:2a:30:26:fc:d6:6c:78:9e:c7
Signer

UPX0
Size: - Virtual size: 148KB

UPX1
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 99KB - Virtual size: 100KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 944B

.rsrc
Size: 99KB - Virtual size: 98KB