228436fe39b933e21f9656d6c3f833d7

Sharing

Copy URL Twitter E-mail

General

Target
228436fe39b933e21f9656d6c3f833d7
Size 558KB
Sample231219-pn52facafk
SHA256 4730270d44a2c1812b4a3f4c06d977cf27f325044f8c339fdaf04a5999aa4713
MD5 228436fe39b933e21f9656d6c3f833d7
SHA1 d745996251ed92b2245215f0462ae0843b464651
SHA512 6e3c601a7b63780707aa6c7845d93c103f6737839e5f494ddfadcfdf132675449f9ce4421a150614f197c5609cad724a8bf5e3d375f443b3669fae992ccaf0dd
SSDEEP 12288:21+vKnoA0cdoIl9jmDBJ4Uh2DEq/51r575O65n9Vh:e+vg0HU9EP4UheEq/B79J
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

228436fe39b933e21f9656d6c3f833d7

.exe 558KB
out.upx

.exe 1.1MB

228436fe39b933e21f9656d6c3f833d7

SHA256 4730270d44a2c1812b4a3f4c06d977cf27f325044f8c339fdaf04a5999aa4713
MD5 228436fe39b933e21f9656d6c3f833d7
SHA1 d745996251ed92b2245215f0462ae0843b464651
SHA512 6e3c601a7b63780707aa6c7845d93c103f6737839e5f494ddfadcfdf132675449f9ce4421a150614f197c5609cad724a8bf5e3d375f443b3669fae992ccaf0dd
SSDEEP 12288:21+vKnoA0cdoIl9jmDBJ4Uh2DEq/51r575O65n9Vh:e+vg0HU9EP4UheEq/B79J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

54:fe:a2:fd:f2:92:ce:85:35:03:0c:c3:2b:43:c7:d4:ae:cc:c0:f3:5f:23:24:ea:be:ce:d9:85:9f:2a:97:58

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Apr 12, 2016

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

31:5f:9f:82:2c:b7:4a:f5:4a:cd:41:2b:de:ab:bd:7f:1b:f2:52:71

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Apr 12, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Serial Number

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

1363696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 f2bde801e735512dcc0566af138e92ff68091807aeed118ff8a26bb3c2ae832a
MD5 1181c93c03194446ac8a8fd56f5a04c6
SHA1 282e0fc76d311f4762529ae60b124b0796ba0bf2
SHA512 dcfb8de3d9ad656a5c0c79aacd0b4d09889c761a225be3105ced169cb4ef0a0214c8cbf92ca08ba68ffa7ac9820f9e50aeae64c994773f9f504847605af56c15
SSDEEP 24576:OArW/8hh0FQAq7c8nA7YMv3+DpBNPRI9ovlG4XozaEhptdPYfCGzeYVxXNVD8pVc:Oe0mfW3YNPRRlG4saIprQN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

746138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

228436fe39b933e21f9656d6c3f833d7

PE Signature issue

PE Signature issue

generic

out.upx

generic