Firefox_Setup_43[.]0[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Firefox_Setup_43.0.1.exe
Size 43.6MB
Sample260919-ph7m3sfc78
SHA256 3375056933f4a577e233243898059feba18763f9a550119dc9d2e5c0bc510a5c
MD5 8970f8c15e27a0064bd412376be21b23
SHA1 27ecafd50c7bb95ab0aa1dc43b4b0c22874579bb
SHA512 0c0baec3edda01b7062d5162266c9b5a5a121389af365d87cc1fd007d33ff69f8c6b6162102e995a45f5111a9e30c86013886b78800b83e092e728ef1e5cf164
SSDEEP 786432:LAv+PMiqcGYp0f8m2vsc4J55k1/avLVDazxDF8UXWXlqy+tgLSSTipXRMPNV:LAbif7Eck5S1/aDVDeFhmlByhMPNV
TLSH
T15FA733638A87783EEB8F293B9C38099C597517074DA3D36F32A873527FB12095C319A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Firefox_Setup_43.0.1.exe

File Explorer

Firefox_Setup_43.0.1.exe

.exe 43.6MB
out.upx

.exe 119KB

Firefox_Setup_43.0.1.exe

SHA256 3375056933f4a577e233243898059feba18763f9a550119dc9d2e5c0bc510a5c
MD5 8970f8c15e27a0064bd412376be21b23
SHA1 27ecafd50c7bb95ab0aa1dc43b4b0c22874579bb
SHA512 0c0baec3edda01b7062d5162266c9b5a5a121389af365d87cc1fd007d33ff69f8c6b6162102e995a45f5111a9e30c86013886b78800b83e092e728ef1e5cf164
SSDEEP 786432:LAv+PMiqcGYp0f8m2vsc4J55k1/avLVDazxDF8UXWXlqy+tgLSSTipXRMPNV:LAbif7Eck5S1/aDVDeFhmlByhMPNV
TLSH
T15FA733638A87783EEB8F293B9C38099C597517074DA3D36F32A873527FB12095C319A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ff:ce:c8:e9:c3:3f:e1:21:d8:2a:2d:91:e2:71:2f:bf:0b:1e:88:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=CA,C=US

Chains

Dec 17, 2015

CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=CA,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=CA,C=US

Serial Number

05:11:ea:f8:57:9e:26:62:be:62:2d:e5:ae:0c:d4:08

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2013 - Sep 21, 2016

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

138800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 4ac3c67beced1310063c771b8530c0c10c16640e8b2a8ffa19e365ead5d8d869
MD5 51614614f565bd8715d1e916ad4ab2dc
SHA1 ac51e511a7cd6fdce162a5ba18289e0181353899
SHA512 25500069d97b66c26a02f451c4ed96906206aae9b4b2f0efb58565c6b97f3117d989cabbaa958630963eadf5cffd3b905d8c182b08ba4629f2c1c47d4363a57d
SSDEEP 3072:ymwiE/+bocWe3i+EKG6eVpDJ4+RDbbNUWp:HwijzWey+HGljDJ4kDbBU0
TLSH
T1F4C36C023AE4CAFAD2410431CE5E7BF5E1E5DE784E61482733943E2DEE7A542D206E6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73023

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Firefox_Setup_43.0.1.exe

PE Signature issue

generic

out.upx

generic