5fe3906f8115f6adde28c3159694f2da4853b541e7a2a46941f9f041e2c330c1

Sharing

Copy URL

Twitter E-mail

General

Target

5fe3906f8115f6adde28c3159694f2da4853b541e7a2a46941f9f041e2c330c1
Size

516KB
MD5

597b209d47a09e062307f1abeb6180f6
SHA1

97e6270922b5c942949f4222bb89c4fc75973eff
SHA256

5fe3906f8115f6adde28c3159694f2da4853b541e7a2a46941f9f041e2c330c1
SHA512

9b4fe54fcda6e7ee27082df1154d734dfa7d0182231a90422d8676e52926875a914a0e399575b1c1b776bed09b925117d8bf8b4c5fc4e7f968fd8dade0c3c30c
SSDEEP

12288:P7xE2BV5fHgcg5kvmRshmzmQ48rEmGcwAPCZqqiziQCtf:ZDH1gCmshy4euCCZ1ixUf

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/out.upx

resource	yara_rule
sample	upx

resource
unpack001/out.upx

Files

5fe3906f8115f6adde28c3159694f2da4853b541e7a2a46941f9f041e2c330c1
.exe windows:4 windows x86 arch:x86

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27-03-2013 20:08

Not After

27-06-2014 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24-01-2013 22:33

Not After

24-04-2014 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30-08-2012 17:49

Not After

30-11-2013 17:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:1b:d5:91:90:3c:33:83:8c:7d:f7:33:6b:46:76:de:11:15:1b:b8:a8:c7:e1:d0:bd:53:69:fc:35:65:fc:1c
Signer

Actual PE Digest

53:1b:d5:91:90:3c:33:83:8c:7d:f7:33:6b:46:76:de:11:15:1b:b8:a8:c7:e1:d0:bd:53:69:fc:35:65:fc:1c

Digest Algorithm

sha256

PE Digest Matches

false

a2:d0:1a:3d:bb:f4:b6:5e:d9:c9:fa:49:46:dc:32:81:47:69:34:34
Signer

Actual PE Digest

a2:d0:1a:3d:bb:f4:b6:5e:d9:c9:fa:49:46:dc:32:81:47:69:34:34

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 708KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 498KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34Certificate

Extended Key Usages

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

53:1b:d5:91:90:3c:33:83:8c:7d:f7:33:6b:46:76:de:11:15:1b:b8:a8:c7:e1:d0:bd:53:69:fc:35:65:fc:1cSigner

a2:d0:1a:3d:bb:f4:b6:5e:d9:c9:fa:49:46:dc:32:81:47:69:34:34Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 708KB

UPX1 Size: 498KB - Virtual size: 500KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 30KB - Virtual size: 30KB

.rdata Size: 6KB - Virtual size: 6KB

.reloc Size: 1.1MB - Virtual size: 1.1MB

.rsrc Size: 6KB - Virtual size: 5KB

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

53:1b:d5:91:90:3c:33:83:8c:7d:f7:33:6b:46:76:de:11:15:1b:b8:a8:c7:e1:d0:bd:53:69:fc:35:65:fc:1c
Signer

a2:d0:1a:3d:bb:f4:b6:5e:d9:c9:fa:49:46:dc:32:81:47:69:34:34
Signer

UPX0
Size: - Virtual size: 708KB

UPX1
Size: 498KB - Virtual size: 500KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 30KB - Virtual size: 30KB

.rdata
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 6KB - Virtual size: 5KB