SBS-CRP-LAP-058_2022-09-30_06_54_52[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

SBS-CRP-LAP-058_2022-09-30_06_54_52.zip
Size

1.2MB
MD5

83991c28bc0e103cdbc619971f3b8a00
SHA1

15bbd33166b586ac6e61cc8a8507657b27ec4647
SHA256

8580adae6ec7a5344af6e17453f08ee12ee8a74784113f5510ca68eb35fe7977
SHA512

9fb7f264665f297e247d0a13ee29f131b327e475b8ee20a1f65456aebb4cac06fbacda38ff5d9294f135f51859916c83ae7f7a056a9035a5f7e204dcd2ecc8c1
SSDEEP

24576:8HzxQtxOF8lgW9hFN0YZWG5FLVz0x9CSmJfgRuup0o5V1sfo9j1YdCmqyRYc2n2:86LOyZvn3IULImF0uuyQsQ91UTRkn2

Score

N/A

Malware Config

Signatures

Files

SBS-CRP-LAP-058_2022-09-30_06_54_52.zip
.zip

Password: Malware123
Device/HarddiskVolume3/Windows/SysWOW64/bgwnflwj/shim64_qxvwfkf.dll
.dll regsvr32 windows x64

Password: Malware123

e24c6a04bae8ee8af218fdd45b0a85cb

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:f6:be:52:34:6c:97:01
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

25/07/2020, 00:48

Not After

25/07/2023, 00:48

Subject

CN=Awareness Technologies\, Inc.,O=Awareness Technologies\, Inc.,L=Westport,ST=Connecticut,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:e6:3a:c9:92:ef:67:ba
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09/09/2020, 07:00

Not After

09/09/2025, 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

67:4b:fe:06:2c:a8:d3:e0:61:a9:bf:87:35:b4:09:76:a3:a3:95:fa:89:f6:57:30:80:bd:6d:62:b2:d6:b9:3e
Signer

Actual PE Digest

67:4b:fe:06:2c:a8:d3:e0:61:a9:bf:87:35:b4:09:76:a3:a3:95:fa:89:f6:57:30:80:bd:6d:62:b2:d6:b9:3e

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Awareness Technologies\, Inc.,O=Awareness Technologies\, Inc.,L=Westport,ST=Connecticut,C=US

10/05/2021, 21:32
Valid: true

Chain 1

CN=Awareness Technologies\, Inc.,O=Awareness Technologies\, Inc.,L=Westport,ST=Connecticut,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
FindFirstFileExW
SetLastError
Sleep
OpenFileMappingW
ProcessIdToSessionId
lstrlenA
lstrcmpiA
lstrcmpiW
SetThreadPriority
GetThreadPriority
GetCurrentThread
VirtualQuery
GetModuleHandleA
SetProcessWorkingSetSize
GetProcessWorkingSetSize
VirtualUnlock
VirtualLock
VirtualProtect
ResumeThread
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
LoadLibraryA
Process32NextW
Process32FirstW
FreeLibraryAndExitThread
WaitForMultipleObjects
OpenProcess
CreateThread
GetSystemDirectoryW
lstrcpyW
ResetEvent
DisableThreadLibraryCalls
MoveFileW
VirtualAlloc
VirtualFree
GetVersionExW
RaiseException
GetHandleInformation
EnterCriticalSection
GetTickCount
lstrcpynW
GetExitCodeThread
FileTimeToSystemTime
CreateFileW
FindFirstFileW
SetEndOfFile
GetLastError
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DeleteFileW
ReleaseMutex
CreateMutexW
GetFileType
GetVersion
CreateEventW
CreateSemaphoreW
SetWaitableTimer
CreateWaitableTimerW
GetCurrentThreadId
GetCurrentProcessId
ReleaseSemaphore
SetEvent
QueryPerformanceFrequency
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLogicalDriveStringsW
QueryDosDeviceW
GetFileSize
ReadFile
WriteFile
GetCurrentProcess
DuplicateHandle
GetTempPathW
LeaveCriticalSection
GetTempFileNameW
GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
GetModuleFileNameW
WaitForSingleObject
CloseHandle
lstrcatA
CreateEventA
WideCharToMultiByte
LocalAlloc
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetComputerNameW
lstrlenW
TerminateThread
LocalFree
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
GetStdHandle
HeapCreate
HeapSetInformation
IsValidCodePage
GetOEMCP
FlsAlloc
TlsSetValue
FlsFree
TlsFree
FlsGetValue
RtlVirtualUnwind
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
FlsSetValue
ExitThread
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
GetThreadLocale
GetLocaleInfoA
HeapSize
HeapReAlloc
HeapDestroy
GetSystemTimeAsFileTime
GlobalSize
CreateMutexA
GetTimeZoneInformation
lstrcatW
FileTimeToLocalFileTime
GlobalAlloc
GlobalFree
FindClose
GlobalReAlloc
GlobalUnlock
GlobalLock
CreateFileA
FindNextFileA
FindFirstFileA
lstrcpynA
GetSystemTime
GetACP
CreateDirectoryW

user32

SendMessageTimeoutW
RegisterWindowMessageW
KillTimer
SetTimer
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
WaitForInputIdle
SetWindowsHookExW
CharLowerBuffW
UnregisterClassA
CallNextHookEx
UnhookWindowsHookEx
PostMessageW
GetDesktopWindow
GetWindowRect
GetSystemMetrics
GetForegroundWindow
IsWindow
GetParent
LoadStringW
GetWindowTextW
ValidateRgn
GetCursorPos
InvalidateRgn
SendMessageW
CharLowerW
GetThreadDesktop
EnumDesktopWindows
GetWindowThreadProcessId
EnumChildWindows
SendNotifyMessageW
GetClassNameW

gdi32

CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetObjectW
GetDIBits

advapi32

CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegGetKeySecurity
RegOpenKeyW
RegSetKeySecurity
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountNameW
ConvertSidToStringSidW
CryptDestroyKey
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RevertToSelf
OpenThreadToken
ImpersonateLoggedOnUser
CryptEncrypt
CryptDecrypt
CryptDeriveKey
SetNamedSecurityInfoW
ConvertStringSidToSidW
CryptAcquireContextW

ole32

CoTaskMemFree
StringFromCLSID
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
GetHGlobalFromStream

oleaut32

SafeArrayCreate
SafeArrayCreateVector
VariantInit
SafeArrayGetElement
SafeArrayPutElement
VariantClear
SysAllocStringByteLen
VarBstrCmp
SysStringByteLen
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen

shlwapi

PathFileExistsW
PathStripPathW
PathRemoveBackslashW
PathAppendW
SHCreateStreamOnFileW
PathRemoveFileSpecW

psapi

GetModuleFileNameExW
EnumProcessModules
GetMappedFileNameW

wtsapi32

WTSQuerySessionInformationW
WTSOpenServerW
WTSFreeMemory
WTSCloseServer

netapi32

NetApiBufferFree
NetWkstaUserEnum

rpcrt4

UuidCreate

dbghelp

ImageDirectoryEntryToData

ws2_32

htons
ntohs
htonl
ntohl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EntryPointW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 349KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHIMDAT
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: Malware123

Password: Malware123

e24c6a04bae8ee8af218fdd45b0a85cb

Code Sign

07Certificate

Key Usages

16:f6:be:52:34:6c:97:01Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

0b:e6:3a:c9:92:ef:67:baCertificate

Extended Key Usages

Key Usages

67:4b:fe:06:2c:a8:d3:e0:61:a9:bf:87:35:b4:09:76:a3:a3:95:fa:89:f6:57:30:80:bd:6d:62:b2:d6:b9:3eSigner

Signature Validations

Verification

10/05/2021, 21:32 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

psapi

wtsapi32

netapi32

rpcrt4

dbghelp

ws2_32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 349KB - Virtual size: 376KB

.pdata Size: 96KB - Virtual size: 95KB

.SHIMDAT Size: 512B - Virtual size: 40B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 20KB

07
Certificate

16:f6:be:52:34:6c:97:01
Certificate

07
Certificate

0b:e6:3a:c9:92:ef:67:ba
Certificate

67:4b:fe:06:2c:a8:d3:e0:61:a9:bf:87:35:b4:09:76:a3:a3:95:fa:89:f6:57:30:80:bd:6d:62:b2:d6:b9:3e
Signer

10/05/2021, 21:32
Valid: true

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 349KB - Virtual size: 376KB

.pdata
Size: 96KB - Virtual size: 95KB

.SHIMDAT
Size: 512B - Virtual size: 40B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 20KB