netpass[.]exe | Triage™

General

Target
netpass.exe
Size 50KB
Sample260802-yjsd8a1clg
SHA256 c3c3992bcf695395df244d93ed91414267d11c78dfa656da117c3131de8a844a
MD5 b4010fad407348dec851a70f06e00e51
SHA1 21e99fb2bbc6854bd1c2c8a7a4fdf96d863e1251
SHA512 5187b34904a1cd3df32ab5aadf8eaa2f5174df0e372ba1dc5184629f0398e9df2295b2e7aae97ab670a004b9169091aa0c6d34dde679cf020ed09f384628e618
SSDEEP 768:SSb5rBojOeBiC65nxngjOOI1PBRqZP9Po/jANsqK8bJFpU6EUVxhOg:SSNrBojVi4jpVP9qcthtE0hOg
TLSH
T1F433CF93CB285544F2948D3080EF8C361E34FD92EA919BAB22C4BD5F7C797A6DE0511A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
static1/unpack001/out.upx	Nirsoft

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
netpass.exe

File Explorer

netpass.exe

.exe 50KB
out.upx

.exe 76KB

netpass.exe

SHA256 c3c3992bcf695395df244d93ed91414267d11c78dfa656da117c3131de8a844a
MD5 b4010fad407348dec851a70f06e00e51
SHA1 21e99fb2bbc6854bd1c2c8a7a4fdf96d863e1251
SHA512 5187b34904a1cd3df32ab5aadf8eaa2f5174df0e372ba1dc5184629f0398e9df2295b2e7aae97ab670a004b9169091aa0c6d34dde679cf020ed09f384628e618
SSDEEP 768:SSb5rBojOeBiC65nxngjOOI1PBRqZP9Po/jANsqK8bJFpU6EUVxhOg:SSNrBojVi4jpVP9qcthtE0hOg
TLSH
T1F433CF93CB285544F2948D3080EF8C361E34FD92EA919BAB22C4BD5F7C797A6DE0511A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9f:8e:73:f4:a8:c2:8e:a8:90:16:d6:2e:e9:e5:2c:9d:a3:0a:8a:b6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Mar 21, 2013

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2012 - Sep 17, 2014

Minor OS version

0

Major OS version

4

Entry point

96288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 1739113fc4be3aee7453f72c7909feb7bedf62d84128a86fd88201d5dd04e983
MD5 9a5704c6d63b6c9c5ff060ef2080c607
SHA1 66dd931924c5e519ba07e3bd43890bee37cbe167
SHA512 72e349c9edf484d3e030b5a13014c3b62b65cf6bf10bacabffb0fbe07a89ea9f32693a4a469dc9b3e45245ce8bd08a09ff5665e05db8e1fb13da3f4d4820bc68
SSDEEP 1536:SzzEPD+TVkOTP+E9ffpAI/HCFQwtEue1E:0zY+TfD+ifpAnbEue1E
TLSH
T1EC734903E6D444B6D2E2563009A66B729FFAFC32D974DA1B5B912D0FAC70AC0DD2534B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

50802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

netpass.exe

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

netpass.exe

PE Signature issue

generic

out.upx

generic