Mcafee[.]zip | Triage

Resubmissions

04/10/2022, 03:02

221004-djq6yaabb2 7

Sharing

Copy URL Twitter E-mail

General

Target

Mcafee.zip
Size

10.5MB
MD5

4224beb338e3e573b4b13043d5ce0bca
SHA1

20c108e7bd0f53b32db1fc79952397a16adf5b75
SHA256

23fe34f7385e77ad18c9d85475dfc02c2254e04b445f05200571c2d5c6b6bd47
SHA512

ad9f6c5007c993f56c79d7c703dd70472706a3a6393097921f9ed7118931de3a49b5b188a560c84add6e3a7838f468941b145b273e2e71e1878eff16940cd42a
SSDEEP

196608:n6ZXQbbdpNRkFLGHZHbJgtdV4UgHWATEMxue3Ypg5wbQb1vfc0ce4ocQuukz1Lmz:8XGJsaL2vHGfXYwwboVfdvq1LK3wUnL

Score

N/A

Malware Config

Signatures

Files

Mcafee.zip
.zip
Mcafee/Setup-11.01.9952.exe
.exe windows x86

bba1ab90ee34d8e80ff8f59047a73d65

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:30:23:24:82:ea:69:a8:e8:69:4b:cb
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 19:28

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 18:58

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:b6:8e:b2:3e:3f:8d:a4:08:ba:da:1c:c4:f0:61:92:85:8f:33:48:0e:94:c6:81:a1:ef:e0:35:fd:cd:0b:e7
Signer

Actual PE Digest

3c:b6:8e:b2:3e:3f:8d:a4:08:ba:da:1c:c4:f0:61:92:85:8f:33:48:0e:94:c6:81:a1:ef:e0:35:fd:cd:0b:e7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

01/08/2019, 15:32
Valid: true

Chain 1

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

76:0f:d8:82:bf:78:c2:eb:98:6a:9b:9e:80:81:32:cd:d0:09:3f:fd
Signer

Actual PE Digest

76:0f:d8:82:bf:78:c2:eb:98:6a:9b:9e:80:81:32:cd:d0:09:3f:fd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

01/08/2019, 15:31
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

msvcp90

?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z

msvcr90

_adjust_fdiv
__p__commode
exit
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
__setusermatherr
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_wsystem
swprintf_s
_configthreadlocale
_initterm_e
_initterm
_onexit
__initenv
__p__fmode
__CxxFrameHandler3
memset

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.0MB - Virtual size: 12.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

bba1ab90ee34d8e80ff8f59047a73d65

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

30:30:23:24:82:ea:69:a8:e8:69:4b:cbCertificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

36:89:c4:13:24:8e:63:d3:a2:78:b4:eaCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

3c:b6:8e:b2:3e:3f:8d:a4:08:ba:da:1c:c4:f0:61:92:85:8f:33:48:0e:94:c6:81:a1:ef:e0:35:fd:cd:0b:e7Signer

Signature Validations

Verification

01/08/2019, 15:32 Valid: true

Chain 1

76:0f:d8:82:bf:78:c2:eb:98:6a:9b:9e:80:81:32:cd:d0:09:3f:fdSigner

Signature Validations

Verification

01/08/2019, 15:31 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp90

msvcr90

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 916B

.rsrc Size: 12.0MB - Virtual size: 12.0MB

.reloc Size: 3KB - Virtual size: 2KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

30:30:23:24:82:ea:69:a8:e8:69:4b:cb
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

3c:b6:8e:b2:3e:3f:8d:a4:08:ba:da:1c:c4:f0:61:92:85:8f:33:48:0e:94:c6:81:a1:ef:e0:35:fd:cd:0b:e7
Signer

01/08/2019, 15:32
Valid: true

76:0f:d8:82:bf:78:c2:eb:98:6a:9b:9e:80:81:32:cd:d0:09:3f:fd
Signer

01/08/2019, 15:31
Valid: false

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 916B

.rsrc
Size: 12.0MB - Virtual size: 12.0MB

.reloc
Size: 3KB - Virtual size: 2KB