CompPkgSup[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CompPkgSup.dll
Size

209KB
MD5

4764fdf30a487e21a9ff1223c9ded770
SHA1

ab5e0de81e9928c64a2db8484585bb0890fc55e2
SHA256

03a2eccde605e36fe90bb632e9e0263fd5da4bfb850a5a3768a215a16f3aa47b
SHA512

cc148b61d0c70c162ae58db2d54fd5438741018b26efeb032e7227f257c0a78fde3c6278ee181b275b628f01b17abea35f789abcfac49e973e21f845e820ef77
SSDEEP

6144:DAotTHT5kk4daR4QwwK1xK5rKEB6HAxELhbfKtTr:MotT1kPrv1c52+ROfKtTr

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

CompPkgSup.dll
.dll windows:6 windows x64 arch:x64

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/07/2015, 00:00

Not After

26/07/2018, 23:59

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:91:39:8c:09:24:77:d6
Certificate

Issuer

SERIALNUMBER=VxnFNSrl,CN=conspiracy.rip,OU=conspiracy,O=conspiracy,C=cn+C=CN,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970,2.5.4.42=#130a636f6e73706972616379,2.5.4.13=#130a636f6e73706972616379,2.5.4.12=#130a636f6e73706972616379,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970

Not Before

25/03/2008, 17:46

Not After

20/11/2024, 17:46

Subject

SERIALNUMBER=VxnFNSrl,CN=conspiracy.rip,OU=conspiracy,O=conspiracy,C=cn+C=CN,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970,2.5.4.42=#130a636f6e73706972616379,2.5.4.13=#130a636f6e73706972616379,2.5.4.12=#130a636f6e73706972616379,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:79:a8:21:70:93:08:af:3c:62:81:56:85:84:d3:9c:9d:75:8c:4c
Signer

Actual PE Digest

14:79:a8:21:70:93:08:af:3c:62:81:56:85:84:d3:9c:9d:75:8c:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

UPX0
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 202KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 394KB - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.retplne
Size: 512B - Virtual size: 200B

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18Certificate

Extended Key Usages

Key Usages

16:91:39:8c:09:24:77:d6Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

14:79:a8:21:70:93:08:af:3c:62:81:56:85:84:d3:9c:9d:75:8c:4cSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.1MB

UPX1 Size: 202KB - Virtual size: 204KB

UPX2 Size: 512B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 394KB - Virtual size: 394KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 6KB - Virtual size: 2.8MB

.pdata Size: 12KB - Virtual size: 11KB

.00cfg Size: 512B - Virtual size: 56B

.fptable Size: 512B - Virtual size: 256B

.retplne Size: 512B - Virtual size: 200B

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 2KB - Virtual size: 2KB

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

16:91:39:8c:09:24:77:d6
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

14:79:a8:21:70:93:08:af:3c:62:81:56:85:84:d3:9c:9d:75:8c:4c
Signer

UPX0
Size: - Virtual size: 3.1MB

UPX1
Size: 202KB - Virtual size: 204KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 394KB - Virtual size: 394KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 6KB - Virtual size: 2.8MB

.pdata
Size: 12KB - Virtual size: 11KB

.00cfg
Size: 512B - Virtual size: 56B

.fptable
Size: 512B - Virtual size: 256B

.retplne
Size: 512B - Virtual size: 200B

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 2KB - Virtual size: 2KB