Firefox-3[.]6[.]24[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Firefox-3.6.24.exe
Size 7.4MB
Sample260808-ajk35sek21
SHA256 25ecaa08feec01c9f5d9437f2e7a583fd5c66fb3e6a155dee6976803acda9270
MD5 ba81b47e7a5f1a060777541e41b08ad5
SHA1 3f5d33887a0c8ea3c70a80289fdd6b0afd3ee9d9
SHA512 193bd3e318f84f7be1d9d318c066aac0ec2f79639220d34bb22defdd39fce0bb2095407d5492822afba137fc88faa47aef67682fd772686720c1ea8ec8f827eb
SSDEEP 196608:g1b6DFTRv0h1w2ItpUV/Xm891O+z5gRLaEejz:U6Uh1SL8/m615gRh8
TLSH
T1F47633929CC2B2A1FC54D530D1EA87B8BD1D7FEADA9B674873A1B8313DF660A0145C4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Firefox-3.6.24.exe

File Explorer

Firefox-3.6.24.exe

.exe 7.4MB
out.upx

.exe 119KB

Firefox-3.6.24.exe

SHA256 25ecaa08feec01c9f5d9437f2e7a583fd5c66fb3e6a155dee6976803acda9270
MD5 ba81b47e7a5f1a060777541e41b08ad5
SHA1 3f5d33887a0c8ea3c70a80289fdd6b0afd3ee9d9
SHA512 193bd3e318f84f7be1d9d318c066aac0ec2f79639220d34bb22defdd39fce0bb2095407d5492822afba137fc88faa47aef67682fd772686720c1ea8ec8f827eb
SSDEEP 196608:g1b6DFTRv0h1w2ItpUV/Xm891O+z5gRLaEejz:U6Uh1SL8/m615gRh8
TLSH
T1F47633929CC2B2A1FC54D530D1EA87B8BD1D7FEADA9B674873A1B8313DF660A0145C4C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

08:19:f4:36:4f:10:69:05:bd:fd:c8:cb:96:19:f0:70:19:9f:e8:9a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Chains

Nov 3, 2011

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Serial Number

6b:26:c6:4d:4e:d9:d8:2a:ab:ef:de:3c:f9:9c:02:15

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Oct 7, 2011 - Oct 29, 2012

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

138496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 8980dc0c179dd12207060f229c4bc9f895fd3af24cd9e91a3fa4e957c0dbd0b3
MD5 3b57fa649db9399fe66608b896371b30
SHA1 c5fcf1681bd51da40011ef2817136d1a4b8358b3
SHA512 33a3848193c2ab406b554668935bc5ac09c372d2c891c22870603ec71c7dfcb01b3540262e4807711276c0d8be7bf46e3abb2205784a088109f2890bff6bd321
SSDEEP 3072:IPrt4hSey15PuSmSCxIhaSPxX1bsSQhsmSRDbbNUEI:IPrehzm5WSmSYXSPxmnh3YDbBU7
TLSH
T114C35B113AE8C5F1E2520431CE9E7BF5D1F1DE784E61492333983E2DAE7A546C20AE6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Firefox-3.6.24.exe

PE Signature issue

generic

out.upx

generic