0db4ff207e8777d0af00653fb3f472b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0db4ff207e8777d0af00653fb3f472b0N.exe
Size

368KB
MD5

0db4ff207e8777d0af00653fb3f472b0
SHA1

3b4e5daf03dbbbd1e790eebdad35d5a242d07210
SHA256

1593ec0cac3d2a7c6d37d30f7a039d9ea34094f69cd75541b22206a68b99eb9e
SHA512

c97f531b47ac6db389abadd23693321549e797fd52cb51af2226cb12ac8ed922bff34a244d9d5177ead840517164ea0c2d872f87899c10cc43063f7f1a12c4f6
SSDEEP

6144:zRaHFU+72WcUmZ2Eex3psxb/tXZSMbfRdMEEYIFbeUFUdyhEWJhmiwVGwYpnuDn:z0HFU+72WcUmZvMkb/tXUMbfMEhq6UFg

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

0db4ff207e8777d0af00653fb3f472b0N.exe
.exe windows:4 windows x86 arch:x86

Code Sign

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2012, 01:00

Not After

08/08/2027, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:dc:25:11:17:c3:dd
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

26/05/2013, 20:20

Not After

30/07/2016, 02:51

Subject

CN=江苏易乐网络科技有限公司,O=江苏易乐网络科技有限公司,L=镇江市,ST=江苏省,C=CN,1.2.840.113549.1.9.1=#0c107369676e4079696c657765622e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

5f:8a:fb:b8:d1:5c:74:a3:e5:91:a7:03:6f:71:49:06:bd:f7:08:ba
Signer

Actual PE Digest

5f:8a:fb:b8:d1:5c:74:a3:e5:91:a7:03:6f:71:49:06:bd:f7:08:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 259KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

19:6d:f8:a7Certificate

Key Usages

1b:dc:25:11:17:c3:ddCertificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

01Certificate

Key Usages

5f:8a:fb:b8:d1:5c:74:a3:e5:91:a7:03:6f:71:49:06:bd:f7:08:baSigner

Headers

File Characteristics

Sections

.text Size: 25KB - Virtual size: 48KB

.rdata Size: 3KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 12KB

.rsrc Size: 259KB - Virtual size: 1.7MB

.aspack Size: 71KB - Virtual size: 72KB

.adata Size: - Virtual size: 4KB

19:6d:f8:a7
Certificate

1b:dc:25:11:17:c3:dd
Certificate

3d
Certificate

01
Certificate

5f:8a:fb:b8:d1:5c:74:a3:e5:91:a7:03:6f:71:49:06:bd:f7:08:ba
Signer

.text
Size: 25KB - Virtual size: 48KB

.rdata
Size: 3KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 12KB

.rsrc
Size: 259KB - Virtual size: 1.7MB

.aspack
Size: 71KB - Virtual size: 72KB

.adata
Size: - Virtual size: 4KB