plugx_2nd_stage.zip
- SHA256 e2f383123254f5b4a91cc8ea7fbe6d2a44c779368777207736a02a125d5c477b
Static task
static1
Behavioral task
behavioral1
Sample
AvastProxy.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AvastProxy.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
wsc.dll
Resource
win7-20221111-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
wsc.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target plugx_2nd_stage.zip
- Size 154KB
- Sample221124-qsdcnafh33
- SHA256 e2f383123254f5b4a91cc8ea7fbe6d2a44c779368777207736a02a125d5c477b
- MD5 a51f331b1f97809f7ea834ac55c95f89
- SHA1 5521c7e2d071e2210f1f02fefcb1f0dddc17986a
- SHA512 def8a36334fe9e1d0d6ef86aca02bca3c10936dadcd9a2330a1298c8ffaa3177ffae299a49eb5dfcdf87934d630b0bb3d9ee6a3165499c52b385b28ca23c6406
- SSDEEP 3072:R+5tveEqSKH5bzm4TEdWP0hj8WGpwIyFLKusSfiYW:ADvhqSmbx2z3GpwrFCHYW
- MD5 SHA1 SHA512 SSDEEP
Score
N/A
Malware Config
Signatures
File Explorer
-
plugx_2nd_stage.zip.zip .ps1 154KB
-
AvastProxy.exe.exe 56KB
-
main.dat135KB
-
wsc.dll.dll 76KB
AvastProxy.exe
- IMPHASH b0468255ffecbc67cb0d635087b49619
- SHA256 560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23
- MD5 feac3e6946ab9b39c66a8756a4a7468f
- SHA1 b490fbb91ebf327173940f3ed93f518191abb5e8
- SHA512 55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b
- SSDEEP 768:alArI/PzmESYUawSgUhuGasKgFADGVih3:alccPz+cwSgUERsI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bf:fd:9e:66:87:49:ae:60:8d:1e:0a:7d:c3:bf:11:21:3f:33:81:29:53:15:29:5f:26:95:89:8e:f1:41:3b:6f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
PE Signature issue
Digest
d6:89:c8:23:ff:eb:6c:8f:86:73:1a:cf:1b:44:34:bb:e8:9c:b5:9a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Subject
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Serial Number
07:c7:0f:7c:ab:14:5b:c1:ed:38:5f:be:69:fa:31:30
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2016 - Oct 4, 2019
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Serial Number
01:e9:39:99:f3:87:1d:10:91:dc:1e:8d:58:b8:d4:05
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 16, 2017 - Jun 24, 2020
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
Major OS version
Entry point
4096
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
LoadLibraryW
GetProcAddress
ExitProcess
FreeLibrary
SetDllDirectoryW
GetCommandLineW
Name
.text
Size
512B
Virtual Size
101B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
766B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
main.dat
- SHA256 c2652596fb983c2b4c9bd3daa97ad992650be070ce4a0d4fbbaba0eb4e43decc
- MD5 9d2d878846afd16a66305f14a369371a
- SHA1 4fe096ccc897209e238fe7ba4458f7f0fd3d75e5
- SHA512 28dad3637b2d28b85624ec52e58e71c7585add68767589dfc14e8aaf96bb246e27cb56cc5d2801bae7e2262d1349e0a0ae931efe7d8c2320726f250df8c167f5
- SSDEEP 3072:wqwSxHbSy2Ax5LgLZJEiWREbbPejBHGBf6cicVccccccccccuue55M:wWbSy2yLsZ6iWE3cHGBf6cicVccccccH
- MD5 SHA1 SHA512 SSDEEP
wsc.dll
- IMPHASH 3a0b42788738c75f4806de99dd496558
- SHA256 a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a
- MD5 dc52696888f68d5b0e3d5e810c0d2a3c
- SHA1 f72a97bf9ab09b3639c3c58c9c34d3675a507b87
- SHA512 22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2
- SSDEEP 768:QVoWTrjr3eBjVgiHYSNjhCgk5NwF6fA6QzJhmlx3eBtBAmtXEty:QXTaySjCJm3mHuNtXEt
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
12868
Magic Number
267
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LocalAlloc
lstrcatA
GetProcAddress
GetModuleHandleA
CloseHandle
ReadFile
CreateFileA
FreeLibrary
ExitProcess
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
RtlUnwind
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetLocaleInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
_run@4
bldfnkrgeikkvqwjouhdhq
hbksdsiiqyblkoxtxwmgcmpbjbieilrjsyjjdwjaoivend
hqipkfebmnvshascsnjxdjgwpcmh
hxhknsuaihxp
jxcwllqwbtguf
lkhybvitivfdpogphbuodjxabysunalmgydb
tubhbbmswnbjmh
vsqwnurbvs
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ