UltraViewer_Desktop[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

UltraViewer_Desktop.exe
Size

1015KB
MD5

5ab012bed08490f91c8d1a3d88489754
SHA1

f16b059fbcae9d565f954c1b8e23a936158e2af4
SHA256

2a5e3fde6af502a36112fe7c56ba77cb5c5fd54e5a3e491e5158e39275ee7c1f
SHA512

cfc2a1bfb6e34b2106e1ed3c7bc08309ffbcae0cb993f98964afbeeb866ea0dfb41e6733d458324b21c6fcb5097e0b89857fca082013c29f9d23c65b93278de7
SSDEEP

24576:yGyxrzD8XOqX1kRjxf6Pi42QVQ5Wdi4Jx0eqTa:Cxrv8ecP6fsJexO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

UltraViewer_Desktop.exe
.exe windows:4 windows x86 arch:x86

Code Sign

36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54
Certificate

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:98:33:ea:cd:d5:b5:12:51:af:e7:fe:29:a8:a4:9d
Certificate

Issuer

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Not Before

30/11/2023, 00:00

Not After

28/11/2026, 23:59

Subject

CN=DUC FABULOUS CO.\,LTD,O=DUC FABULOUS CO.\,LTD,ST=Ha Noi,C=VN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/02/2023, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:da:6c:13:80:1e:56:e4:70:10:f9:ef:3b:31:91:87:83:d4:01:d3:4a:3b:15:10:be:12:8e:bf:99:ce:9b:1b
Signer

Actual PE Digest

da:da:6c:13:80:1e:56:e4:70:10:f9:ef:3b:31:91:87:83:d4:01:d3:4a:3b:15:10:be:12:8e:bf:99:ce:9b:1b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 842KB - Virtual size: 844KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54Certificate

Extended Key Usages

Key Usages

f1:98:33:ea:cd:d5:b5:12:51:af:e7:fe:29:a8:a4:9dCertificate

Extended Key Usages

Key Usages

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cbCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

da:da:6c:13:80:1e:56:e4:70:10:f9:ef:3b:31:91:87:83:d4:01:d3:4a:3b:15:10:be:12:8e:bf:99:ce:9b:1bSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.3MB

UPX1 Size: 842KB - Virtual size: 844KB

.rsrc Size: 164KB - Virtual size: 168KB

Headers

File Characteristics

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.data Size: 4KB - Virtual size: 116KB

.rsrc Size: 168KB - Virtual size: 164KB

36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54
Certificate

f1:98:33:ea:cd:d5:b5:12:51:af:e7:fe:29:a8:a4:9d
Certificate

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

da:da:6c:13:80:1e:56:e4:70:10:f9:ef:3b:31:91:87:83:d4:01:d3:4a:3b:15:10:be:12:8e:bf:99:ce:9b:1b
Signer

UPX0
Size: - Virtual size: 3.3MB

UPX1
Size: 842KB - Virtual size: 844KB

.rsrc
Size: 164KB - Virtual size: 168KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.data
Size: 4KB - Virtual size: 116KB

.rsrc
Size: 168KB - Virtual size: 164KB