ba54ee6c0a69ba601f0154d12aa85035d956c651bcc9639b5ba7ae5ec4602fe0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ba54ee6c0a69ba601f0154d12aa85035d956c651bcc9639b5ba7ae5ec4602fe0.exe
Size

244KB
MD5

1f11835934e74afd0b337cab1d6c6887
SHA1

bba702812bbacff61a64ab27f389f19cf2d88590
SHA256

ba54ee6c0a69ba601f0154d12aa85035d956c651bcc9639b5ba7ae5ec4602fe0
SHA512

f357ea378232df323cc94ee52c51a0a2dac024a0769e4a3a8ae6795e4cd94e50691e372915f11b931813dbbb100f543f18c3331b13fe85c1974eb5c5fbff6b17
SSDEEP

3072:U1JlRF25crZhe5r68gHd4wIEHDMkzFLp9vSP7c/L/rqILD2+zn/2A9R:UnlRqcraa4OHDMk10cjDTDd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

ba54ee6c0a69ba601f0154d12aa85035d956c651bcc9639b5ba7ae5ec4602fe0.exe
.exe windows:6 windows x86 arch:x86

Code Sign

19:b7:19:b7:e5:65:3c:2a:8c:a7:a7:44:30:3b:c8:54
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

04/07/2017, 06:49

Not After

04/09/2019, 06:49

Subject

CN=Zhangkong Internet Technology Co.\, Ltd.,O=Zhangkong Internet Technology Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:3f:54:8b:e6:a9:00:a7:06:a9:e3:c1:10:56:2d:65:06:a3:ac:8d:13:49:6c:33:9f:58:13:87:da:bc:3d:43
Signer

Actual PE Digest

ba:3f:54:8b:e6:a9:00:a7:06:a9:e3:c1:10:56:2d:65:06:a3:ac:8d:13:49:6c:33:9f:58:13:87:da:bc:3d:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 348KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 186KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 306KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

19:b7:19:b7:e5:65:3c:2a:8c:a7:a7:44:30:3b:c8:54Certificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

ba:3f:54:8b:e6:a9:00:a7:06:a9:e3:c1:10:56:2d:65:06:a3:ac:8d:13:49:6c:33:9f:58:13:87:da:bc:3d:43Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 348KB

UPX1 Size: 186KB - Virtual size: 188KB

.rsrc Size: 47KB - Virtual size: 48KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 306KB - Virtual size: 305KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 5KB - Virtual size: 17KB

.rsrc Size: 92KB - Virtual size: 92KB

.reloc Size: 14KB - Virtual size: 13KB

19:b7:19:b7:e5:65:3c:2a:8c:a7:a7:44:30:3b:c8:54
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

19:c2:85:30:e9:3b:36
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

ba:3f:54:8b:e6:a9:00:a7:06:a9:e3:c1:10:56:2d:65:06:a3:ac:8d:13:49:6c:33:9f:58:13:87:da:bc:3d:43
Signer

UPX0
Size: - Virtual size: 348KB

UPX1
Size: 186KB - Virtual size: 188KB

.rsrc
Size: 47KB - Virtual size: 48KB

.text
Size: 306KB - Virtual size: 305KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 5KB - Virtual size: 17KB

.rsrc
Size: 92KB - Virtual size: 92KB

.reloc
Size: 14KB - Virtual size: 13KB