General

Malware Config

Signatures

Files

• 7601726164.zip

  .zip

  Password: infected

• 509f6bb22524158322b48975cd1bb634bc0d9a460389565296b640f62c31cdd7

  .exe windows x86

  8e509efc29aa3364c399f520e8cefdac

  
  

  Code Sign

  ca:38:54:72:9b:19:84:4a:7b:4a:d4:71:c6:25:08:5d

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-02-2021 00:00

  Not After

  12-02-2022 23:59

  Subject

  CN=ANGOSTONE GROUP LTD LIMITED,O=ANGOSTONE GROUP LTD LIMITED,POSTALCODE=HA8 6AF,STREET=140 Dale Avenue,L=Edgware,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  01-02-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  42:f7:1a:ac:78:ee:b8:18:c3:8f:cf:dc:00:5c:e1:78:d8:cb:6a:4a

  Signer

  Actual PE Digest

  42:f7:1a:ac:78:ee:b8:18:c3:8f:cf:dc:00:5c:e1:78:d8:cb:6a:4a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=ANGOSTONE GROUP LTD LIMITED,O=ANGOSTONE GROUP LTD LIMITED,POSTALCODE=HA8 6AF,STREET=140 Dale Avenue,L=Edgware,C=GB

  24-06-2022 16:55

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetModuleFileNameW

  GetModuleHandleW

  FindFirstFileW

  FindNextFileW

  FindClose

  CreateProcessW

  WriteConsoleW

  FlushFileBuffers

  SetFilePointerEx

  GetConsoleMode

  WideCharToMultiByte

  GetLastError

  MultiByteToWideChar

  GetStringTypeW

  EncodePointer

  DecodePointer

  SetLastError

  InitializeCriticalSectionAndSpinCount

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetProcAddress

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  LCMapStringW

  GetLocaleInfoW

  GetCPInfo

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  InitializeSListHead

  RtlUnwind

  RaiseException

  FreeLibrary

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  GetACP

  HeapFree

  HeapAlloc

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  HeapReAlloc

  GetFileType

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  CloseHandle

  SetStdHandle

  HeapSize

  GetConsoleCP

  CreateFileW

  user32

  AllowSetForegroundWindow

  WaitForInputIdle

  Sections

  .text

  Size: 108KB - Virtual size: 108KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 63KB - Virtual size: 62KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 288KB - Virtual size: 288KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .Paratot

  Size: 350KB - Virtual size: 353KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ