a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.zip
- SHA256 b8f7abca3b0147fa30f3f0fcf63a1e2426ee4f0b6d07ef2155f02aac87cf41fe
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.zip
- Size 487KB
- Sample220705-jhsahafbap
- SHA256 b8f7abca3b0147fa30f3f0fcf63a1e2426ee4f0b6d07ef2155f02aac87cf41fe
- MD5 e4619510458ce472b31702cb625753d7
- SHA1 526fbbad182b218351817c43ca80a3171e8ee58e
- SHA512 8570f60d33659edab9072377be72128bed9fd610756f5f59f729f5be5833e1cb822e277951e742f78f32cd1793424bae6bceb42565e6c92bef03972da41dd4df
- SSDEEP 12288:n5fJZNlJG+Vab7gkQyuwRUnkhHP7OBOMCtxqMrrRRA9mrOcjlR:nJLJmUxAg0HDOBKw0ry6OcBR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.dll family_hermeticwizard - Hermeticwiper family
File Explorer
-
a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.zip.zip 487KB
-
a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.dll.dll 682KB
a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.dll
- IMPHASH e099d3524b6906cf8460b4e6db0b11f2
- SHA256 a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec
- MD5 517d2b385b846d6ea13b75b8adceb061
- SHA1 3c54c9a49a8ddca02189fe15fea52fe24f41a86f
- SHA512 1de912f50b7f5cc2f4fcea7b6d3c84a39bd15d668122f50a9b11da66447ed99f456e86e006d0dfe7ab0fca7dc8e35efa7ff57959033463d94ef37e5705515430
- SSDEEP 12288:J4WCTqjtByJsZrjIYlkytnSg9hcr1DnDH2iRNL5tj1XUNgASK4CTfVf1WZ62PNTr:HGqRBRtnSEhMhDH2iRNL5tj1XUNgASKw
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
98:ea:94:e6:f3:a0:68:a7:61:02:5e:4a:70:24:b6:a3:c4:df:f9:65
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Subject
SERIALNUMBER=HE 419469,CN=Hermetica Digital Ltd,O=Hermetica Digital Ltd,L=Nicosia,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 13, 2021 - Apr 14, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
Major OS version
Entry point
75760
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSectionEx
Thread32First
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
WaitForSingleObjectEx
RaiseException
DecodePointer
CreateProcessW
OpenThread
GetExitCodeProcess
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetModuleFileNameW
GetProcessId
GetCurrentThreadId
DuplicateHandle
GetModuleHandleA
GetLocalTime
GetCurrentDirectoryW
GetWindowsDirectoryW
GetComputerNameExA
VirtualQuery
GetSystemDirectoryW
GetExitCodeThread
TerminateThread
CreateThread
SizeofResource
FindResourceA
LockResource
LoadResource
WriteConsoleW
SetEndOfFile
FlushFileBuffers
SleepEx
Sleep
GetTickCount
GetProcessHeap
HeapAlloc
HeapSize
HeapFree
CloseHandle
GetLastError
Thread32Next
CreateNamedPipeW
DeleteCriticalSection
LocalFree
InitializeCriticalSection
SetStdHandle
HeapReAlloc
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetConsoleCP
WriteFile
OutputDebugStringA
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetCurrentThread
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
ReadFile
LoadLibraryExW
TlsFree
TerminateProcess
FreeLibrary
LoadLibraryW
GetProcAddress
VerifyVersionInfoW
CreateFileW
VerSetConditionMask
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
OutputDebugStringW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
user32
UnregisterClassA
advapi32
FreeSid
GetLengthSid
InitializeAcl
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
SetSecurityDescriptorDacl
RegCloseKey
AllocateAndInitializeSid
RegCreateKeyExW
InitializeSecurityDescriptor
AddAccessAllowedAce
shell32
CommandLineToArgvW
ole32
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
ws2_32
htons
ioctlsocket
WSAGetLastError
WSACleanup
WSAStartup
getsockopt
getaddrinfo
inet_addr
WSAAddressToStringW
htonl
freeaddrinfo
ntohl
connect
setsockopt
select
closesocket
__WSAFDIsSet
recv
WSAStringToAddressA
send
shutdown
socket
mpr
WNetCancelConnection2W
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetAddConnection2W
iphlpapi
GetIpNetTable
GetAdaptersAddresses
GetTcpTable
dnsapi
DnsQuery_W
DnsFree
netapi32
NetServerEnum
NetApiBufferFree
crypt32
CertNameToStrA
secur32
FreeContextBuffer
InitializeSecurityContextA
DeleteSecurityContext
QueryContextAttributesA
ApplyControlToken
rpcrt4
UuidCreate
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
305KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
297KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ