b9ea78140bb057ce7ee9ab9d8da98cb88cb0116e26394f006fd749c524987438

Sharing

Copy URL Twitter E-mail

General

Target

b9ea78140bb057ce7ee9ab9d8da98cb88cb0116e26394f006fd749c524987438
Size

5.6MB
MD5

e6f30e01f897066143dc868c61e3ac18
SHA1

5f2ad2bfd8d84ee7343cf6273c9c93233cc1e391
SHA256

b9ea78140bb057ce7ee9ab9d8da98cb88cb0116e26394f006fd749c524987438
SHA512

152b3b266cea0ef831922eae7f2e6be3282ad085172b966c9e60fd46469c5aa390aa08b3a1c504a90f54580159af0c18fd0fa169472bdb35881fab5cac8279a2
SSDEEP

98304:EX1lteKp3LZMZlajFIU9geqZjWzP3sy0A3Ba9bq8y3nw2TTx2AlZK:+lteybZMZlajF3TyYcy06BLHhtlg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

b9ea78140bb057ce7ee9ab9d8da98cb88cb0116e26394f006fd749c524987438
.exe windows:5 windows x86 arch:x86

Code Sign

38:3d:38:93:2d:ee:ea:46:b7:c0:c1:1d:5b:6d:2d:c6
Certificate

Issuer

CN=珠海市杰理科技股份有限公司

Not Before

27/10/2017, 06:22

Not After

31/12/2039, 23:59

Subject

CN=珠海市杰理科技股份有限公司 - 核心工具部

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b5:ce:ba:04:94:28:6b:98:66:cd:f6:ab:a9:c3:21:ca:bf:1c:43:3a
Signer

Actual PE Digest

b5:ce:ba:04:94:28:6b:98:66:cd:f6:ab:a9:c3:21:ca:bf:1c:43:3a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 7.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:3d:38:93:2d:ee:ea:46:b7:c0:c1:1d:5b:6d:2d:c6Certificate

Extended Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

b5:ce:ba:04:94:28:6b:98:66:cd:f6:ab:a9:c3:21:ca:bf:1c:43:3aSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 7.5MB

UPX1 Size: 5.1MB - Virtual size: 5.1MB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 8.5MB - Virtual size: 8.5MB

.rdata Size: 3.4MB - Virtual size: 3.4MB

.data Size: 112KB - Virtual size: 170KB

.qtmetad Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 13B

_RDATA Size: 1024B - Virtual size: 560B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 307KB - Virtual size: 306KB

38:3d:38:93:2d:ee:ea:46:b7:c0:c1:1d:5b:6d:2d:c6
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

b5:ce:ba:04:94:28:6b:98:66:cd:f6:ab:a9:c3:21:ca:bf:1c:43:3a
Signer

UPX0
Size: - Virtual size: 7.5MB

UPX1
Size: 5.1MB - Virtual size: 5.1MB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 8.5MB - Virtual size: 8.5MB

.rdata
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 112KB - Virtual size: 170KB

.qtmetad
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 13B

_RDATA
Size: 1024B - Virtual size: 560B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 307KB - Virtual size: 306KB