094e878480baa822400e10a67fce87c1b6e917616d11ffdd1110174668105d61

Sharing

Copy URL Twitter E-mail

General

Target

094e878480baa822400e10a67fce87c1b6e917616d11ffdd1110174668105d61
Size

1.4MB
MD5

71469f12fa2b860b4766e882721b553f
SHA1

3044ccc322ee3cbe20820a57b458d1d9b0bc93ed
SHA256

094e878480baa822400e10a67fce87c1b6e917616d11ffdd1110174668105d61
SHA512

ebec9f26839aac2ce1b2a44de008c9a10eb543829816068c03de8fc8151fd71c3c3df1bea0ca67b0198eeb8343d8ae2dede7c708830d2765c65e343b870831be
SSDEEP

24576:oELrxlDMDzQ/kpfyl0xf/WNWafpl2BIYo4V/W/mBXQZBG/YrZ7BIZ8w5b6essUDe:13Hyf7xncTi1oEBXZ/YrZ7BC8w96MUDe

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack002/ASL_SignMaker64.dll	acprotect
static1/unpack004/ExeinfoPE_Run.dll	acprotect
static1/unpack006/Run_ExeinfoPe.dll	acprotect
static1/unpack008/COMPDEMO.dll	acprotect

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/ASL_SignMaker64.dll	upx
static1/unpack004/ExeinfoPE_Run.dll	upx
static1/unpack006/Run_ExeinfoPe.dll	upx
static1/unpack008/COMPDEMO.dll	upx

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack002/ASL_SignMaker64.dll
unpack004/ExeinfoPE_Run.dll
unpack005/out.upx
unpack006/Run_ExeinfoPe.dll
unpack007/out.upx
unpack008/COMPDEMO.dll
unpack009/out.upx

Files

094e878480baa822400e10a67fce87c1b6e917616d11ffdd1110174668105d61
.zip
plugins-master/ASL_SignMaker64_v01.zip
.zip
ASL_SignMaker64.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DoMyJob
LoadDll

Sections

UPX0
Size: - Virtual size: 364KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 177KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SignMaker-screen.png
.png
exeinfope-screen.png
.png
plugins-master/ExeinfoPE_Run_for_PPEE.zip
.zip
!usage Screen.png
.png
ExeinfoPE_Run.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Wolf

Sections

UPX0
Size: - Virtual size: 292KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 169KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
file_id.diz
plugins-master/ExeinfoPe_VBasic_plugin01.zip
.zip
ReadMe.txt
Run_ExeinfoPe.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

VBDecompilerPluginAuthor
VBDecompilerPluginLoad
VBDecompilerPluginName

Sections

UPX0
Size: - Virtual size: 276KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 158KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 326KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 159B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins-master/GPInstall_TCOMP.zip
.zip
ARC_TCcompresst.png
.png
COMPDEMO.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

About
DoMyJob
LoadDll

Sections

UPX0
Size: - Virtual size: 540KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 636KB - Virtual size: 636KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 105B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Readme.txt
plugins-master/PPEE(puppy)_Run_for_ExeinfoPE.zip
.zip
plugins-master/README.md
plugins-master/Source_code_PEiD-0.95-20081103_ExeinfoPE.zip
.zip
plugins-master/Yara_Anitidebug_StrDbg_v01.zip
.zip
plugins-master/plugin-die-exeinfo.zip
.zip
plugins-master/plugin_for_QuickUnpack_v0001.zip
.zip
plugins-master/wwwhelper_v03.zip
.zip

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 364KB

UPX1 Size: 177KB - Virtual size: 180KB

.rsrc Size: 6KB - Virtual size: 8KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 292KB

UPX1 Size: 169KB - Virtual size: 172KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 350KB - Virtual size: 349KB

.itext Size: 2KB - Virtual size: 1KB

.data Size: 7KB - Virtual size: 6KB

.bss Size: - Virtual size: 13KB

.idata Size: 10KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 73B

.reloc Size: 24KB - Virtual size: 23KB

.rsrc Size: 17KB - Virtual size: 17KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 276KB

UPX1 Size: 158KB - Virtual size: 160KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 326KB - Virtual size: 325KB

.itext Size: 2KB - Virtual size: 1KB

.data Size: 7KB - Virtual size: 6KB

.bss Size: - Virtual size: 13KB

.idata Size: 9KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 159B

.reloc Size: 21KB - Virtual size: 21KB

.rsrc Size: 14KB - Virtual size: 13KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 540KB

UPX1 Size: 288KB - Virtual size: 288KB

.rsrc Size: 9KB - Virtual size: 12KB

Headers

File Characteristics

Sections

.text Size: 636KB - Virtual size: 636KB

.itext Size: 3KB - Virtual size: 2KB

.data Size: 13KB - Virtual size: 12KB

.bss Size: - Virtual size: 13KB

.idata Size: 11KB - Virtual size: 10KB

.edata Size: 512B - Virtual size: 105B

.reloc Size: 50KB - Virtual size: 50KB

.rsrc Size: 44KB - Virtual size: 44KB

UPX0
Size: - Virtual size: 364KB

UPX1
Size: 177KB - Virtual size: 180KB

.rsrc
Size: 6KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 292KB

UPX1
Size: 169KB - Virtual size: 172KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 350KB - Virtual size: 349KB

.itext
Size: 2KB - Virtual size: 1KB

.data
Size: 7KB - Virtual size: 6KB

.bss
Size: - Virtual size: 13KB

.idata
Size: 10KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 73B

.reloc
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 17KB - Virtual size: 17KB

UPX0
Size: - Virtual size: 276KB

UPX1
Size: 158KB - Virtual size: 160KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 326KB - Virtual size: 325KB

.itext
Size: 2KB - Virtual size: 1KB

.data
Size: 7KB - Virtual size: 6KB

.bss
Size: - Virtual size: 13KB

.idata
Size: 9KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 159B

.reloc
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 14KB - Virtual size: 13KB

UPX0
Size: - Virtual size: 540KB

UPX1
Size: 288KB - Virtual size: 288KB

.rsrc
Size: 9KB - Virtual size: 12KB

.text
Size: 636KB - Virtual size: 636KB

.itext
Size: 3KB - Virtual size: 2KB

.data
Size: 13KB - Virtual size: 12KB

.bss
Size: - Virtual size: 13KB

.idata
Size: 11KB - Virtual size: 10KB

.edata
Size: 512B - Virtual size: 105B

.reloc
Size: 50KB - Virtual size: 50KB

.rsrc
Size: 44KB - Virtual size: 44KB