7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d

Sharing

Copy URL Twitter E-mail

General

Target
7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d
Size 610KB
Sample260706-j6bbwsf14k
SHA256 7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d
MD5 3d3fd40fcb76259e0a77e252baedfa2b
SHA1 cfd95e918105e5d25e288bcc34fc0043ae72b4b5
SHA512 4575d4589a88b7eb21f20fb4fb4a6b95e2a9bb67e0757cd348216aeb7b6689bdac585b6e84031f37f4f2597dea21ecd47202bf771540e8b0ae00ab7c2bbf1f32
SSDEEP 12288:uE52VhiUd2p+AgEGZKJrlieFk/jooMPRriXBSEJ7B9cZT:uxiUc+hEGZKJpiePRrIB9u
TLSH
T199D423C370A1099BED2A38783DB8DD961DACF8A8CAD458FC51357A537BF96701CAC201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d

.exe 610KB
out.upx

.exe 1.4MB

7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d

SHA256 7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d
MD5 3d3fd40fcb76259e0a77e252baedfa2b
SHA1 cfd95e918105e5d25e288bcc34fc0043ae72b4b5
SHA512 4575d4589a88b7eb21f20fb4fb4a6b95e2a9bb67e0757cd348216aeb7b6689bdac585b6e84031f37f4f2597dea21ecd47202bf771540e8b0ae00ab7c2bbf1f32
SSDEEP 12288:uE52VhiUd2p+AgEGZKJrlieFk/jooMPRriXBSEJ7B9cZT:uxiUc+hEGZKJpiePRrIB9u
TLSH
T199D423C370A1099BED2A38783DB8DD961DACF8A8CAD458FC51357A537BF96701CAC201
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

d5:91:10:97:a4:50:17:6b:44:be:e2:e5:32:98:83:17:18:86:19:dd:4c:ff:87:79:d6:02:19:29:c2:1a:c5:c4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

07:1f:a3:3b:b6:bd:8f:10:10:42:ed:aa:0e:b2:dd:28

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 8, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1484256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

out.upx

SHA256 311c023449ad8b37463cab36d6f1bb1e99954091846e36a43304390efdfe44ab
MD5 4d071e7b722955baeb61885fe8e89289
SHA1 5d0c87e27139b5b8a4acb4c0225fa24a3af2eb5e
SHA512 a475e3e048fa254456930955fcea094fd69978573d6e38c72e9acf0e074917bd00d08ac361b3c4b4b1cf0b13ceb5452534f95872e37cc6d3f70fc36d2b4a1192
SSDEEP 24576:J69+RtiUm7jZLoCclF8X6Te2hfrb0MReawywhOT38:w92ibyCclzi2te1a
TLSH
T1BD658D4E77BA01B4C5B78078CD9A5A47F6B178450B609FCF06945AE72B2BAD8063F331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

468200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

__swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

7f0595487ca8bd1c6407ad26534a238482c0bd3d867e0d66275ba06130060e0d

PE Signature issue

generic

out.upx

generic