30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c

Sharing

Copy URL Twitter E-mail

General

Target
30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
Size 645KB
Sample220502-ccnlsseccl
SHA256 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
MD5 e68e0aebbf004b1fd55018a03e3b634f
SHA1 e97810b8a8f700dc7cdf284e774d74e975686d87
SHA512 38da5d322a435a5ac2e2f6a322dbbff4f01a2d3a8b639aafde72000126bcfb8937f242570c334c819ad5728c5402cdd97a12750eef37ce8173c3b31950b2498a
SSDEEP 12288:nD7TBJq0VYA8cFdM690+i/f9WM5XLaBxPV6MpIe+hrU+aBs4+aDIlaBTp2iN2rn:nDq0Vlp/M6k9XkzpIdfaBsm4alpdNQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c

.exe 645KB
out.upx

.exe 2.5MB

30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c

SHA256 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
MD5 e68e0aebbf004b1fd55018a03e3b634f
SHA1 e97810b8a8f700dc7cdf284e774d74e975686d87
SHA512 38da5d322a435a5ac2e2f6a322dbbff4f01a2d3a8b639aafde72000126bcfb8937f242570c334c819ad5728c5402cdd97a12750eef37ce8173c3b31950b2498a
SSDEEP 12288:nD7TBJq0VYA8cFdM690+i/f9WM5XLaBxPV6MpIe+hrU+aBs4+aDIlaBTp2iN2rn:nDq0Vlp/M6k9XkzpIdfaBsm4alpdNQ
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

ab:49:0f:3e:6a:b7:30:c9:1e:7e:ae:ac:89:8c:9d:78:7b:a0:14:be:4a:9f:92:de:9b:9a:6a:3b:a3:9c:74:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Subject

CN=Team Media Group Inc.,O=Team Media Group Inc.,POSTALCODE=L8G 4J3,STREET=22 Mathers Drive,L=Hamilton,ST=Ontario,C=CA

Serial Number

a3:f3:90:83:63:ba:61:50:18:36:fb:76:16:a6:57:7c

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 18, 2020 - Sep 18, 2021

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2641488

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 ff3133d8db4b4107ceba97d7171ee9fb904f3189540935e64fdb91c1e1d36cc1
MD5 748438f81dbe8bf4eeb58555de634514
SHA1 87cfa20e2a2761d811ac8e69cf8569590c244176
SHA512 0a3375e229696eacbfaeb9ce4fabe40abd60b6bff4987df36db6d01718211b57e7e8cb1631fbc1e9351e897cad4dca6791e8ff7db96638a44cbc47dcabce4cbf
SSDEEP 24576:IlZbSAEG+1abniQ1O2IX58tCio4VUdEEsNRpxGVD8g:IlVUsAD5Di9Et
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

828100

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

805KB

Virtual Size

808KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

164KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CQSVNSGL

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ