socelars | 13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78

Sharing

Copy URL

Twitter E-mail

General

Target

13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78
Size

569KB
MD5

eab34089ba89eb30bab4d46d0d1d7c63
SHA1

676f13707c42ff4b0324ae9854096729f7541d0f
SHA256

13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78
SHA512

c47ac4760e1950575d2f5012b2bfd029cbf1d670f9e075f2b2faa18a129785957342d3bef0f3120e37c4610a221f489aef705b8e647da0861d678278e77bff6e
SSDEEP

12288:Usvgl0VMwKMPAkY9XLbonPNopIsjVVU2anU6J7MsdwG:FMwK4OwnrsPUvrJ7MsdwG

Score

10^/10

upx socelars

Malware Config

Extracted

Family

socelars

http://www.createinfo.pw/

http://www.allinfo.pw/

Signatures

Socelars family
socelars
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

resource	yara_rule
sample	upx

Files

13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78
.exe windows x86

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:fb:77:b2:e1:59:11:97
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

17-09-2019 07:00

Not After

17-09-2024 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7b:18:27:3a:e7:16:18:4f:3c:f6:08:72
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

28-05-2019 08:38

Not After

07-03-2020 08:50

Subject

SERIALNUMBER=91310114MA1GTPJA23,CN=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,O=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085348414e47484149,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:18:27:3a:e7:16:18:4f:3c:f6:08:72
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

28-05-2019 08:38

Not After

07-03-2020 08:50

Subject

SERIALNUMBER=91310114MA1GTPJA23,CN=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,O=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085348414e47484149,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:fb:77:b2:e1:59:11:97
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

17-09-2019 07:00

Not After

17-09-2024 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

69:25:05:45:9a:f4:f6:61:cc:25:aa:df:3a:20:f0:1d:4a:69:9a:98:8c:52:41:47:bc:63:8c:fe:d9:4e:1e:51
Signer

Actual PE Digest

69:25:05:45:9a:f4:f6:61:cc:25:aa:df:3a:20:f0:1d:4a:69:9a:98:8c:52:41:47:bc:63:8c:fe:d9:4e:1e:51

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91310114MA1GTPJA23,CN=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,O=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085348414e47484149,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

30-09-2019 07:33
Valid: true

Chain 1

SERIALNUMBER=91310114MA1GTPJA23,CN=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,O=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085348414e47484149,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

bc:f3:34:ec:ad:2a:ab:8c:23:d7:ad:9d:6f:b9:05:88:e9:96:16:4d
Signer

Actual PE Digest

bc:f3:34:ec:ad:2a:ab:8c:23:d7:ad:9d:6f:b9:05:88:e9:96:16:4d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91310114MA1GTPJA23,CN=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,O=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085348414e47484149,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

30-09-2019 07:33
Valid: true

Chain 1

SERIALNUMBER=91310114MA1GTPJA23,CN=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,O=Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085348414e47484149,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 724KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 819KB - Virtual size: 819KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 1024B - Virtual size: 758B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zelda_m
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zelda_m
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

85:fb:77:b2:e1:59:11:97Certificate

Extended Key Usages

Key Usages

7b:18:27:3a:e7:16:18:4f:3c:f6:08:72Certificate

Extended Key Usages

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

7b:18:27:3a:e7:16:18:4f:3c:f6:08:72Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

85:fb:77:b2:e1:59:11:97Certificate

Extended Key Usages

Key Usages

69:25:05:45:9a:f4:f6:61:cc:25:aa:df:3a:20:f0:1d:4a:69:9a:98:8c:52:41:47:bc:63:8c:fe:d9:4e:1e:51Signer

Signature Validations

Verification

30-09-2019 07:33 Valid: true

Chain 1

bc:f3:34:ec:ad:2a:ab:8c:23:d7:ad:9d:6f:b9:05:88:e9:96:16:4dSigner

Signature Validations

Verification

30-09-2019 07:33 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 724KB

UPX1 Size: 456KB - Virtual size: 456KB

.rsrc Size: 99KB - Virtual size: 100KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 819KB - Virtual size: 819KB

.zelda_m Size: 5KB - Virtual size: 4KB

.zelda_m Size: 4KB - Virtual size: 3KB

.zelda_m Size: 2KB - Virtual size: 1KB

.zelda_m Size: 1024B - Virtual size: 758B

.zelda_m Size: 5KB - Virtual size: 4KB

.zelda_m Size: 6KB - Virtual size: 5KB

.zelda_m Size: 1KB - Virtual size: 1KB

.rdata Size: 141KB - Virtual size: 140KB

.data Size: 8KB - Virtual size: 16KB

.zelda_m Size: 512B - Virtual size: 80B

.rsrc Size: 99KB - Virtual size: 98KB

.reloc Size: 27KB - Virtual size: 26KB

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

07
Certificate

85:fb:77:b2:e1:59:11:97
Certificate

7b:18:27:3a:e7:16:18:4f:3c:f6:08:72
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

7b:18:27:3a:e7:16:18:4f:3c:f6:08:72
Certificate

07
Certificate

85:fb:77:b2:e1:59:11:97
Certificate

69:25:05:45:9a:f4:f6:61:cc:25:aa:df:3a:20:f0:1d:4a:69:9a:98:8c:52:41:47:bc:63:8c:fe:d9:4e:1e:51
Signer

30-09-2019 07:33
Valid: true

bc:f3:34:ec:ad:2a:ab:8c:23:d7:ad:9d:6f:b9:05:88:e9:96:16:4d
Signer

30-09-2019 07:33
Valid: true

UPX0
Size: - Virtual size: 724KB

UPX1
Size: 456KB - Virtual size: 456KB

.rsrc
Size: 99KB - Virtual size: 100KB

.text
Size: 819KB - Virtual size: 819KB

.zelda_m
Size: 5KB - Virtual size: 4KB

.zelda_m
Size: 4KB - Virtual size: 3KB

.zelda_m
Size: 2KB - Virtual size: 1KB

.zelda_m
Size: 1024B - Virtual size: 758B

.zelda_m
Size: 5KB - Virtual size: 4KB

.zelda_m
Size: 6KB - Virtual size: 5KB

.zelda_m
Size: 1KB - Virtual size: 1KB

.rdata
Size: 141KB - Virtual size: 140KB

.data
Size: 8KB - Virtual size: 16KB

.zelda_m
Size: 512B - Virtual size: 80B

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 27KB - Virtual size: 26KB