Archive[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Archive.zip
Size

339KB
MD5

652ceac59c1f20e91346e169d5c160ce
SHA1

38269e8bf149e9701342007cc0de55d5f74347e5
SHA256

2f566aa4e7513164e8cea067fa2c7a73900ce7160de16265257a4fac1aa4b2d8
SHA512

a5c6d3f3342d60e279b4072b20582512284c436ccd8f26d0d70455a2e1d3c27b20de0c4867f725c3a6b4d4fde806b5a62b0fca69fb2399d678b957c9be80d5af
SSDEEP

6144:h5ZkJBs2fn82g1IRCVQEPjF6giR82kEmC25PD7wpjbLkd+N2P9musxgEBzxKl9RZ:hsJ5fn82g0vPRe5r7wpzjMPcurE29P

Score

N/A

Malware Config

Signatures

Files

Archive.zip
.zip
__MACOSX/._deM4Rkhbpscpv32WmOKZlLnUmdp0ZIrbBLMAHPKXnmk.bin
__MACOSX/._mvVwjFjfHs6au49Ysf30QKyzIuSMYyugzhPSVog3y7o.bin
__MACOSX/._ntCqCkDIZPZf_Gf9a4SRRneGzhvGD9HlXzAKD65ad7Q.bin
deM4Rkhbpscpv32WmOKZlLnUmdp0ZIrbBLMAHPKXnmk.bin
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mvVwjFjfHs6au49Ysf30QKyzIuSMYyugzhPSVog3y7o.bin
.dll windows x64

16f5c48a394efff088addaff920e75e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

GetUserNameW

kernel32

CloseHandle
CreateProcessA
CreateSemaphoreW
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentThreadId
GetDiskFreeSpaceExA
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
GlobalMemoryStatusEx
HeapCreate
InitializeCriticalSection
IsDBCSLeadByteEx
K32EnumProcesses
LeaveCriticalSection
MultiByteToWideChar
RaiseException
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
fputs
free
fwrite
localeconv
malloc
memcpy
memset
realloc
strcmp
strerror
strlen
strncmp
vfprintf
wcscmp
wcslen
_write

user32

GetCursorPos

Exports

Exports

_GCC_specific_handler
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
_Z12checkcrprAm1v
_Z3runv
_Z5checkv
_Z6gemactv
_Z7numprocv
_Z8gemdrivev
_Z8genboxslv
_Z8lessthanv
_Z9wsbdtusnmv
_ZN2nt6cipherEPcyy
adler32
adler32_combine
adler32_combine64
adler32_z
crc32
crc32_combine
crc32_combine64
crc32_z
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
inflate_copyright
inflate_fast
inflate_table
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ntCqCkDIZPZf_Gf9a4SRRneGzhvGD9HlXzAKD65ad7Q.bin
.exe windows x64

Code Sign

33:00:00:01:3c:ed:d3:5c:e9:30:dd:53:d0:00:00:00:00:01:3c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/10/2019, 23:17

Not After

21/01/2021, 23:17

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:fb:e5:c1:ab:e4:d3:ea:89:85:06:2a:55:08:d2:99:fe:8e:6e:f5:6a:48:3f:b2:85:06:74:1e:2b:c6:c9:87
Signer

Actual PE Digest

79:fb:e5:c1:ab:e4:d3:ea:89:85:06:2a:55:08:d2:99:fe:8e:6e:f5:6a:48:3f:b2:85:06:74:1e:2b:c6:c9:87

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/09/2022, 10:46
Valid: false

70:5b:b6:71:a4:c1:91:69:09:9e:27:ed:41:d9:95:8c:49:e8:b5:d8
Signer

Actual PE Digest

70:5b:b6:71:a4:c1:91:69:09:9e:27:ed:41:d9:95:8c:49:e8:b5:d8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

24/11/2019, 10:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 484KB - Virtual size: 484KB

.rsrc Size: 1024B - Virtual size: 956B

.reloc Size: 512B - Virtual size: 12B

16f5c48a394efff088addaff920e75e8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.data Size: 292KB - Virtual size: 292KB

.rdata Size: 24KB - Virtual size: 24KB

.pdata Size: 4KB - Virtual size: 3KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 2KB

.edata Size: 2KB - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 756B

Code Sign

33:00:00:01:3c:ed:d3:5c:e9:30:dd:53:d0:00:00:00:00:01:3cCertificate

Extended Key Usages

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51Certificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

79:fb:e5:c1:ab:e4:d3:ea:89:85:06:2a:55:08:d2:99:fe:8e:6e:f5:6a:48:3f:b2:85:06:74:1e:2b:c6:c9:87Signer

Signature Validations

Verification

23/09/2022, 10:46 Valid: false

70:5b:b6:71:a4:c1:91:69:09:9e:27:ed:41:d9:95:8c:49:e8:b5:d8Signer

Signature Validations

Verification

24/11/2019, 10:04 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 35KB - Virtual size: 34KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 484KB - Virtual size: 484KB

.rsrc
Size: 1024B - Virtual size: 956B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 100KB - Virtual size: 99KB

.data
Size: 292KB - Virtual size: 292KB

.rdata
Size: 24KB - Virtual size: 24KB

.pdata
Size: 4KB - Virtual size: 3KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 2KB - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 756B

33:00:00:01:3c:ed:d3:5c:e9:30:dd:53:d0:00:00:00:00:01:3c
Certificate

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

79:fb:e5:c1:ab:e4:d3:ea:89:85:06:2a:55:08:d2:99:fe:8e:6e:f5:6a:48:3f:b2:85:06:74:1e:2b:c6:c9:87
Signer

23/09/2022, 10:46
Valid: false

70:5b:b6:71:a4:c1:91:69:09:9e:27:ed:41:d9:95:8c:49:e8:b5:d8
Signer

24/11/2019, 10:04
Valid: false

.text
Size: 35KB - Virtual size: 34KB

.rsrc
Size: 2KB - Virtual size: 2KB