General

Malware Config

Signatures

Files

• Photo_Eva_Elfie_Album.zip.7z

  .7z

  Password: infected

• Photo_Eva_Elfie_Album.zip

  .zip
• '

  .exe windows x64

  a2ef21de31b3dac585954e210475f61a

  
  

  Code Sign

  0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2031 00:00

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  02:6a:53:45:5c:c7:00:12:fa:23:ce:7a:80:f8:5e:47

  Certificate

  Issuer

  CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-07-2013 12:00

  Not After

  22-10-2023 12:00

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  09-06-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  09-04-2021 00:00

  Not After

  19-06-2024 23:59

  Subject

  CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  1e:7b:5a:58:be:a7:1c:53:f7:10:e0:53:d7:72:75:90:87:f6:88:f9:a4:d7:1e:04:94:5a:9f:ed:d3:e1:e9:15

  Signer

  Actual PE Digest

  1e:7b:5a:58:be:a7:1c:53:f7:10:e0:53:d7:72:75:90:87:f6:88:f9:a4:d7:1e:04:94:5a:9f:ed:d3:e1:e9:15

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

  05-07-2022 11:13

  Valid: true

  Chain 1

  CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mozglue

  ??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AEBV?$ProfilerStringView@D@1@AEBVMarkerCategory@1@$$QEAVMarkerOptions@1@UTextMarker@markers@01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ??0PrintfTarget@mozilla@@IEAA@XZ

  ??1MutexImpl@detail@mozilla@@QEAA@XZ

  ??2@YAPEAX_K@Z

  ??3@YAXPEAX@Z

  ??3@YAXPEAX_K@Z

  ??GTimeStampValue@mozilla@@QEBA_KAEBV01@@Z

  ??_U@YAPEAX_K@Z

  ??_V@YAXPEAX@Z

  ?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAEAW4ProcessInitState@123@XZ

  ?CleanupProcessRuntime@mozilla@@YAXXZ

  ?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPEAUHINSTANCE__@@HPEAPEAD@Z

  ?DllBlocklist_Initialize@@YAXI@Z

  ?DllBlocklist_SetBasicDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z

  ?DllBlocklist_SetFullDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z

  ?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ

  ?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPEAVProfilingStack@23@XZ

  ?IsWin32kLockedDown@mozilla@@YA_NXZ

  ?MapRemoteViewOfFile@mozilla@@YAPEAXPEAX0_K01KK@Z

  ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z

  ?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ

  ?SetWin32kLockedDownInPolicy@mozilla@@YAXXZ

  ?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ

  ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AEAAXXZ

  ?gTwoCharEscapes@detail@mozilla@@3QBDB

  ?lock@MutexImpl@detail@mozilla@@IEAAXXZ

  ?profiler_current_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ

  ?profiler_init@baseprofiler@mozilla@@YAXPEAX@Z

  ?profiler_shutdown@baseprofiler@mozilla@@YAXXZ

  ?unlock@MutexImpl@detail@mozilla@@IEAAXXZ

  ?vprint@PrintfTarget@mozilla@@QEAA_NPEBDPEAD@Z

  _wcsdup

  free

  malloc

  moz_xmalloc

  mozalloc_abort

  realloc

  strdup

  ntdll

  NtMapViewOfSection

  NtOpenFile

  NtQueryInformationProcess

  NtQueryVirtualMemory

  NtReadVirtualMemory

  NtUnmapViewOfSection

  RtlAcquireSRWLockExclusive

  RtlAcquireSRWLockShared

  RtlAllocateHeap

  RtlCaptureContext

  RtlCaptureStackBackTrace

  RtlCompareMemory

  RtlCompareUnicodeString

  RtlDuplicateUnicodeString

  RtlEqualUnicodeString

  RtlFreeHeap

  RtlFreeUnicodeString

  RtlGetLastWin32Error

  RtlGetVersion

  RtlInitUnicodeString

  RtlLookupFunctionEntry

  RtlNtStatusToDosError

  RtlQueryPerformanceCounter

  RtlReAllocateHeap

  RtlReleaseSRWLockExclusive

  RtlReleaseSRWLockShared

  RtlRunOnceExecuteOnce

  RtlRunOnceInitialize

  RtlSetLastWin32Error

  RtlVirtualUnwind

  VerSetConditionMask

  memcmp

  memcpy

  memmove

  memset

  msvcp140

  ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ??0ios_base@std@@IEAA@XZ

  ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??1ios_base@std@@UEAA@XZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

  ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?fail@ios_base@std@@QEBA_NXZ

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ?good@ios_base@std@@QEBA_NXZ

  ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

  ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z

  ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

  ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

  ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

  kernel32

  AcquireSRWLockExclusive

  AssignProcessToJobObject

  AttachConsole

  CloseHandle

  CreateEventW

  CreateFileA

  CreateFileMappingA

  CreateFileMappingW

  CreateFileW

  CreateIoCompletionPort

  CreateJobObjectW

  CreateMutexW

  CreateNamedPipeW

  CreateProcessW

  CreateRemoteThread

  CreateThread

  CreateToolhelp32Snapshot

  DebugBreak

  DeleteCriticalSection

  DeleteFileW

  DeleteProcThreadAttributeList

  DuplicateHandle

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesEx

  ExpandEnvironmentStringsW

  FlushInstructionCache

  FreeEnvironmentStringsW

  FreeLibrary

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentProcessorNumber

  GetCurrentThread

  GetCurrentThreadId

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  GetFileType

  GetLastError

  GetLongPathNameW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetNativeSystemInfo

  GetProcAddress

  GetProcessHandleCount

  GetProcessHeaps

  GetProcessId

  GetProductInfo

  GetQueuedCompletionStatus

  GetStartupInfoW

  GetStdHandle

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetThreadId

  GetTickCount

  GetUserDefaultLCID

  GetUserDefaultLangID

  GetUserDefaultLocaleName

  GetVersionExW

  GlobalMemoryStatusEx

  HeapDestroy

  HeapSetInformation

  InitOnceExecuteOnce

  InitializeCriticalSection

  InitializeCriticalSectionAndSpinCount

  InitializeCriticalSectionEx

  InitializeProcThreadAttributeList

  InitializeSListHead

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsWow64Process

  LeaveCriticalSection

  LoadLibraryExA

  LoadLibraryExW

  LoadLibraryW

  LocalFree

  MapViewOfFile

  Module32FirstW

  Module32NextW

  MultiByteToWideChar

  OpenProcess

  OutputDebugStringA

  PostQueuedCompletionStatus

  ProcessIdToSessionId

  QueryFullProcessImageNameW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReadFile

  ReadProcessMemory

  RegisterWaitForSingleObject

  ReleaseSRWLockExclusive

  ResetEvent

  ResumeThread

  SearchPathW

  SetDllDirectoryW

  SetEnvironmentVariableW

  SetEvent

  SetFilePointerEx

  SetHandleInformation

  SetInformationJobObject

  SetLastError

  SetStdHandle

  SetThreadAffinityMask

  SetUnhandledExceptionFilter

  SignalObjectAndWait

  Sleep

  TerminateJobObject

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  UnmapViewOfFile

  UnregisterWait

  UnregisterWaitEx

  UpdateProcThreadAttribute

  VerifyVersionInfoW

  VirtualAlloc

  VirtualAllocEx

  VirtualFree

  VirtualFreeEx

  VirtualProtect

  VirtualProtectEx

  VirtualQuery

  WaitForSingleObject

  WaitForSingleObjectEx

  WideCharToMultiByte

  WriteFile

  WriteProcessMemory

  lstrlenW

  vcruntime140

  _CxxThrowException

  __C_specific_handler

  __CxxFrameHandler3

  __std_terminate

  _purecall

  strrchr

  wcschr

  api-ms-win-crt-stdio-l1-1-0

  __acrt_iob_func

  __p__commode

  __stdio_common_vfprintf

  __stdio_common_vsnprintf_s

  __stdio_common_vsnwprintf_s

  __stdio_common_vswprintf

  _dup

  _fileno

  _get_osfhandle

  _set_fmode

  _wfopen

  _wtmpnam_s

  fclose

  fgets

  freopen

  api-ms-win-crt-environment-l1-1-0

  __p__environ

  _putenv

  _wgetenv

  getenv

  api-ms-win-crt-runtime-l1-1-0

  __p___argc

  __p___wargv

  _beginthreadex

  _c_exit

  _cexit

  _configure_wide_argv

  _crt_atexit

  _errno

  _exit

  _get_initial_wide_environment

  _initialize_onexit_table

  _initialize_wide_environment

  _initterm

  _initterm_e

  _invalid_parameter_noinfo_noreturn

  _register_onexit_function

  _register_thread_local_exe_atexit_callback

  _seh_filter_exe

  _set_app_type

  exit

  terminate

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  _fdopen

  api-ms-win-crt-time-l1-1-0

  _gmtime64_s

  _time64

  strftime

  api-ms-win-crt-convert-l1-1-0

  _ltoa_s

  wcstoul

  api-ms-win-crt-string-l1-1-0

  _stricmp

  _wcslwr_s

  _wcsnicmp

  strcpy

  strlen

  tolower

  towlower

  towupper

  wcscat_s

  wcscmp

  wcscpy

  wcscpy_s

  wcslen

  wcsncmp

  wcsncpy

  wcspbrk

  wcstok_s

  api-ms-win-crt-filesystem-l1-1-0

  _wmakepath_s

  _wsplitpath_s

  api-ms-win-crt-utility-l1-1-0

  _byteswap_uint64

  rand_s

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  Exports

  Exports

  GetDependentModulePaths

  GetHandleVerifier

  GetNtLoaderAPI

  IsSandboxedProcess

  NativeNtBlockSet_Write

  TargetConfigureOPMProtectedOutput

  TargetConfigureOPMProtectedOutput64

  TargetCreateNamedPipeW

  TargetCreateNamedPipeW64

  TargetCreateOPMProtectedOutputs

  TargetCreateOPMProtectedOutputs64

  TargetCreateProcessA

  TargetCreateProcessA64

  TargetCreateProcessW

  TargetCreateProcessW64

  TargetCreateThread

  TargetCreateThread64

  TargetDestroyOPMProtectedOutput

  TargetDestroyOPMProtectedOutput64

  TargetEnumDisplayDevicesA

  TargetEnumDisplayDevicesA64

  TargetEnumDisplayMonitors

  TargetEnumDisplayMonitors64

  TargetGdiDllInitialize

  TargetGdiDllInitialize64

  TargetGetCertificate

  TargetGetCertificate64

  TargetGetCertificateByHandle

  TargetGetCertificateByHandle64

  TargetGetCertificateSize

  TargetGetCertificateSize64

  TargetGetCertificateSizeByHandle

  TargetGetCertificateSizeByHandle64

  TargetGetMonitorInfoA

  TargetGetMonitorInfoA64

  TargetGetMonitorInfoW

  TargetGetMonitorInfoW64

  TargetGetOPMInformation

  TargetGetOPMInformation64

  TargetGetOPMRandomNumber

  TargetGetOPMRandomNumber64

  TargetGetStockObject

  TargetGetStockObject64

  TargetGetSuggestedOPMProtectedOutputArraySize

  TargetGetSuggestedOPMProtectedOutputArraySize64

  TargetNtCreateEvent

  TargetNtCreateEvent64

  TargetNtCreateFile

  TargetNtCreateFile64

  TargetNtCreateKey

  TargetNtCreateKey64

  TargetNtCreateSection

  TargetNtCreateSection64

  TargetNtMapViewOfSection

  TargetNtMapViewOfSection64

  TargetNtOpenEvent

  TargetNtOpenEvent64

  TargetNtOpenFile

  TargetNtOpenFile64

  TargetNtOpenKey

  TargetNtOpenKey64

  TargetNtOpenKeyEx

  TargetNtOpenKeyEx64

  TargetNtOpenProcess

  TargetNtOpenProcess64

  TargetNtOpenProcessToken

  TargetNtOpenProcessToken64

  TargetNtOpenProcessTokenEx

  TargetNtOpenProcessTokenEx64

  TargetNtOpenThread

  TargetNtOpenThread64

  TargetNtOpenThreadToken

  TargetNtOpenThreadToken64

  TargetNtOpenThreadTokenEx

  TargetNtOpenThreadTokenEx64

  TargetNtQueryAttributesFile

  TargetNtQueryAttributesFile64

  TargetNtQueryFullAttributesFile

  TargetNtQueryFullAttributesFile64

  TargetNtSetInformationFile

  TargetNtSetInformationFile64

  TargetNtSetInformationThread

  TargetNtSetInformationThread64

  TargetNtUnmapViewOfSection

  TargetNtUnmapViewOfSection64

  TargetRegisterClassW

  TargetRegisterClassW64

  TargetSetOPMSigningKeyAndSequenceNumbers

  TargetSetOPMSigningKeyAndSequenceNumbers64

  g_handles_to_close

  g_interceptions

  g_nt

  g_originals

  g_shared_IPC_size

  g_shared_delayed_integrity_level

  g_shared_delayed_mitigations

  g_shared_policy_size

  g_shared_section

  Sections

  .text

  Size: 318KB - Virtual size: 317KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 54KB - Virtual size: 53KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .freestd

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 17B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 221KB - Virtual size: 220KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Photo_Eva_Elfie_Album.vbs