30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c

Sharing

Copy URL

Twitter E-mail

General

Target

30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
Size

645KB
MD5

e68e0aebbf004b1fd55018a03e3b634f
SHA1

e97810b8a8f700dc7cdf284e774d74e975686d87
SHA256

30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
SHA512

38da5d322a435a5ac2e2f6a322dbbff4f01a2d3a8b639aafde72000126bcfb8937f242570c334c819ad5728c5402cdd97a12750eef37ce8173c3b31950b2498a
SSDEEP

12288:nD7TBJq0VYA8cFdM690+i/f9WM5XLaBxPV6MpIe+hrU+aBs4+aDIlaBTp2iN2rn:nDq0Vlp/M6k9XkzpIdfaBsm4alpdNQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
.exe windows x86

Code Sign

a3:f3:90:83:63:ba:61:50:18:36:fb:76:16:a6:57:7c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18-09-2020 00:00

Not After

18-09-2021 23:59

Subject

CN=Team Media Group Inc.,O=Team Media Group Inc.,POSTALCODE=L8G 4J3,STREET=22 Mathers Drive,L=Hamilton,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:49:0f:3e:6a:b7:30:c9:1e:7e:ae:ac:89:8c:9d:78:7b:a0:14:be:4a:9f:92:de:9b:9a:6a:3b:a3:9c:74:20
Signer

Actual PE Digest

ab:49:0f:3e:6a:b7:30:c9:1e:7e:ae:ac:89:8c:9d:78:7b:a0:14:be:4a:9f:92:de:9b:9a:6a:3b:a3:9c:74:20

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Team Media Group Inc.,O=Team Media Group Inc.,POSTALCODE=L8G 4J3,STREET=22 Mathers Drive,L=Hamilton,ST=Ontario,C=CA

28-04-2022 17:35
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 604KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 805KB - Virtual size: 808KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 164KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CQSVNSGL
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

a3:f3:90:83:63:ba:61:50:18:36:fb:76:16:a6:57:7cCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

ab:49:0f:3e:6a:b7:30:c9:1e:7e:ae:ac:89:8c:9d:78:7b:a0:14:be:4a:9f:92:de:9b:9a:6a:3b:a3:9c:74:20Signer

Signature Validations

Verification

28-04-2022 17:35 Valid: false

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.9MB

UPX1 Size: 604KB - Virtual size: 608KB

.rsrc Size: 30KB - Virtual size: 32KB

Headers

File Characteristics

Sections

CODE Size: 805KB - Virtual size: 808KB

DATA Size: 7KB - Virtual size: 8KB

BSS Size: - Virtual size: 4KB

.idata Size: 10KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: 48KB - Virtual size: 52KB

.rsrc Size: 72KB - Virtual size: 72KB

.reloc Size: 164KB - Virtual size: 168KB

CQSVNSGL Size: 1.4MB - Virtual size: 1.4MB

a3:f3:90:83:63:ba:61:50:18:36:fb:76:16:a6:57:7c
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

ab:49:0f:3e:6a:b7:30:c9:1e:7e:ae:ac:89:8c:9d:78:7b:a0:14:be:4a:9f:92:de:9b:9a:6a:3b:a3:9c:74:20
Signer

28-04-2022 17:35
Valid: false

UPX0
Size: - Virtual size: 1.9MB

UPX1
Size: 604KB - Virtual size: 608KB

.rsrc
Size: 30KB - Virtual size: 32KB

CODE
Size: 805KB - Virtual size: 808KB

DATA
Size: 7KB - Virtual size: 8KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 10KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: 48KB - Virtual size: 52KB

.rsrc
Size: 72KB - Virtual size: 72KB

.reloc
Size: 164KB - Virtual size: 168KB

CQSVNSGL
Size: 1.4MB - Virtual size: 1.4MB