PA$$w0rds_1234__NewFiles1--D7[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

PA$$w0rds_1234__NewFiles1--D7.rar
Size

7.0MB
MD5

5c9500d898d976d9243898b0ba67b21f
SHA1

8833235be13ef8a0595d4be071ac9ed5c98d2d0a
SHA256

67d5bd624c4acc28929e75a96b3db6ebf46844cca982f8f583c3afb3019b55d5
SHA512

8a9a1089d5e453159c73eae4e7f223da75509282fc224f1adee96c51f47fd003f8528146d53e9993518635e636e48452b64348fabbfaaa50c47d3d0e32464aae
SSDEEP

196608:f7gSxwOGPpPOAqmSVdr22YGL8oOP7LRgdCkI3ryNjrdNixxJc94xO:cSxWp+9hYGL8DfqskIeFAYkO

Score

N/A

Malware Config

Signatures

Files

PA$$w0rds_1234__NewFiles1--D7.rar
.rar

Password: 1234
PA$$W0RDz is == 1234.txt
SetupsCrakedz1.exe
.exe windows x86

Password: 1234

f9d630ca8ef98b1b948a3b0c7d80a0b0

Code Sign

b7:93:55:41:1b:9b:3f:fc:e2:c5:59:33:2a:fa:0f:4c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07-03-2019 00:00

Not After

07-03-2023 23:59

Subject

CN=Mark Straver,O=Mark Straver,POSTALCODE=57333,STREET=Östra Järnvägsgatan 1A,L=Tranås,ST=Jönköpingslän,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:2b:eb:2d:4c:9c:f0:7f:de:c1:cd:5e:7d:dc:d8:46:9b:93:e2:31:96:1d:ba:e8:1a:0f:79:ea:35:17:f9:9d
Signer

Actual PE Digest

d9:2b:eb:2d:4c:9c:f0:7f:de:c1:cd:5e:7d:dc:d8:46:9b:93:e2:31:96:1d:ba:e8:1a:0f:79:ea:35:17:f9:9d

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Mark Straver,O=Mark Straver,POSTALCODE=57333,STREET=Östra Järnvägsgatan 1A,L=Tranås,ST=Jönköpingslän,C=SE

04-07-2019 19:06
Valid: true

Chain 1

CN=Mark Straver,O=Mark Straver,POSTALCODE=57333,STREET=Östra Järnvägsgatan 1A,L=Tranås,ST=Jönköpingslän,C=SE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpynA
GetUserDefaultLCID
GetSystemInfo
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

GetUserNameW

user32

CharUpperBuffW

Exports

Exports

?j7l��<*��y�$m�3}�Ru��!2l-*� �*�晸?*"��u��3��.��Rh��Xh��')� ��d��cڈ1��!�Il0��d�<1B-�(_:u� �.�vg+ �+�7P�Avs�Jh*�+�S:�;��T~TYf��r�zn�QN2B��g�^ʹb��1d��ϖ>V��".3�5�<xfiQ��Źwd�!�� V�p�VN��E=nREɸva�N�$��(��JR<�!F��!W��o��Ao�=c��0Q ��t�C��?Yt ��g�\lՕ�F��b�� [��1�v)&IG��Mi9�X�L�Đ��a 3S�Xk�r��a�t��mk"�� 8#Y��ht B�z;׳��W��jZ��W�V� �)�8��$,Te�;P=!0ۃ4��(��<��xm��?&�<C�(h��] � i��m��rF�9��=�dϰ�� R��#\P�|��Gff�B��/�Zy�L��V9��1�EX��[_LQ��p��(1� �%Z1X}�h\̕�a�� D{��/�cs?�31��y7`�IG��R��U��"�d:n�?m�/��X4�!�4o��p��9�V�7̕��=��dau�#��&t{�=.�*��`]յ��SN/!%y_�,��p��#R�>�W�?~�6�"�� b4wu|�[:�pE�)�Id�7��.b.��q,X{��{�.��?�#@n��b�az=�e��<7�e�e�K��҉��U��]Z��H�M~��?�J;ed�N/��.�_аi�k ��o�qݔ08}��vJ��T��B/��Zv*,��^FS�;3�u��7B��n�D˿�;g�`SM�@0h�Pe�a:��u��f�] �؎�g�(�Y�8��ĭ��w{ w�^��צ��ԏ`r�J�`��:�|>�6q�U��"�_1�m�wb��F�Ӳ�:��,��2�r��ѵ��d�az}"+7�oO�9"y��y�J[lxD@N~�� b��ث��5�� 8KP��QZ��F��m�� E��;lIK�75�+�+��'C~�׺��iNPI�� 2��y��%��%^*3�L(#��#�߇�-�ǋ�+?��Fcb�B� �i_��麚u�E��A��zO*:PX�j4i�/0�Њ�w��##�l�~6�v|�3��k7"#�nX��yl2B}"�r��PE�x"�*:�`�,c�v7�d�6�X$�-�$��+Y�rB��䄯5�8'��0ku��N�""4��LZ�KL�;�,v5�� lL��$Hz�,JS��˗�<3gL��r��j98�/ov�K�vJ ��}3�? Z��uq�^s�r؜�ʶ��g��o��ET�#>��l�k�~T��@XB�G��I�_�n��NL6 ��_Bj��#>��z�^8W^�"l�l��e��x��Ok�_0`�hEr��*X�8J�m��X8(e�� !L=�lZ�{(]��o�%i �n��1>��u�2��s?��|��g\�'z�F�(ī5�1Q�N �O�h��o�L7��2-J�ʔ�U4��!�Nfy��M�%|��o�n��n�Τ@�Gh@xv��bNۏ<�6@-T��$*�M�{�.�=3��1Pv{Az��M�2��ⷄ�*G�C�z��@ :'�D�$�d,6mf�e"��!��(-�O��u��|�tM��c��<{��r%�[��V֟��|��ؘ!%��P�e8Ų��"�"��XA�� y�3Z)��P��y�BٛA��H�hY48Ҧ��#І�X��GH�� >)��%n��ٰ�|ba�߬�έ��m�J�8mt�>��?��,�� 028=��$#�� )�w{az$��2E^�fq�-�`�]|q:��ǫݽUU�Q[��Nxiq~z�vq��v��'J�q��BwБ}��U+">v�4��7�´�)�|��P�S��qr��kiI��S��OF�p7�ܨ�Ά_9� .2�g�A�d�MːPƛ�I��݇�Ӗd�T5��2d~�6�3��r��U��l<yDb�^mI��MX��^�_=�83\|ʑ'm��6��l��}7+�2u#��b�`Ic/o�� *��:�o�B��r��C�i�nd�yy�4j��0\�6��@��.C��ͬM׽w_A��o�-I�C~ضhz��q5��˦�W [��)�#��!��,��ʽ>-�"�S�M6��&��`��w��>7�S��pr�[թ��t��n�� 7 �b5PR��$�F$?U��֏�v �M��2��3tc�I��/��_�4ܽEE��/�2 r��~yZt��mγ�PN��>dl�w�?�[ܚ5��R�]��Smxv"��'Lq0��R��|>@Ʀ!Ɋc��~��J�#�Q(r��t��v꧕/��R��M��.�Ń��YOyr��i*�uB�nܖ�;e��,I�Ѩk��R�N�p�9S�}:Z��F;|�V�^��i�W�6_$.��u��U5��> n�Y�XI��IX��8 '��b�s�}��\=ҫT�G��t�S_��gJ�mJ��FZ�}4O-��/a`��t{t��J�I�<�a�� P�i�C��~�w�Cp��!�?��sׅb��jAp�=��ۦ�MF�h��W��?2��u��`/��qw� ��E��;q�C�AE�Fe��Wy��6��Ϟ�?VL��$:��&�8_`�Y�XK]�"f�i��LAW|A��'��?��Nq�K��m�Y��]`TH��Qh��,�D>�%�1.X}5i#Y��|aL��E��Y ��^J'�x�J�V��X��]��h�:F�5�C(j%-��1pX�lY��`xc�H��!��.��A�*�\�?WX��Dz��]� �S

Sections

.text
Size: - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.K*!
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.$eH
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.`XJ
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1234

Password: 1234

f9d630ca8ef98b1b948a3b0c7d80a0b0

Code Sign

b7:93:55:41:1b:9b:3f:fc:e2:c5:59:33:2a:fa:0f:4cCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

d9:2b:eb:2d:4c:9c:f0:7f:de:c1:cd:5e:7d:dc:d8:46:9b:93:e2:31:96:1d:ba:e8:1a:0f:79:ea:35:17:f9:9dSigner

Signature Validations

Verification

04-07-2019 19:06 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

Exports

Exports

Sections

.text Size: - Virtual size: 41KB

.rdata Size: - Virtual size: 6KB

.data Size: - Virtual size: 5KB

.K*! Size: - Virtual size: 4.0MB

.$eH Size: 1024B - Virtual size: 880B

.`XJ Size: 7.0MB - Virtual size: 7.0MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 74KB - Virtual size: 74KB

b7:93:55:41:1b:9b:3f:fc:e2:c5:59:33:2a:fa:0f:4c
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

d9:2b:eb:2d:4c:9c:f0:7f:de:c1:cd:5e:7d:dc:d8:46:9b:93:e2:31:96:1d:ba:e8:1a:0f:79:ea:35:17:f9:9d
Signer

04-07-2019 19:06
Valid: true

.text
Size: - Virtual size: 41KB

.rdata
Size: - Virtual size: 6KB

.data
Size: - Virtual size: 5KB

.K*!
Size: - Virtual size: 4.0MB

.$eH
Size: 1024B - Virtual size: 880B

.`XJ
Size: 7.0MB - Virtual size: 7.0MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 74KB - Virtual size: 74KB