MDE_File_Sample_45f4aee4c518d2a5efce43f5d0973f8523db34fb[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

MDE_File_Sample_45f4aee4c518d2a5efce43f5d0973f8523db34fb.zip
Size

12.4MB
MD5

84b0e24fd9b7f185f823705d58ec9403
SHA1

f2cff57ed65b2ddd42505918aada2b60f2f5327d
SHA256

4559b69f3fb26b231e4877d991223f9418519ffe0f80d4152a2abc00c8115b6c
SHA512

10cf07370966cef9fe58afa6284dc9b6fcb1a71c5733bc7028095b2a1cd7496483da70c55ef366058f50982f7b95ede90d8c685a8a903773cbe4499301d97dbf
SSDEEP

196608:hzZfc7l8LS8RMSQISzHlkBAYEL/Hvuy1+TLQ6cHTC3TE0Js5rQQXIralLWjNrgZD:/slNU5SJuAEmSTuTC+WQFWFOyj4

Score

N/A

Malware Config

Signatures

Files

MDE_File_Sample_45f4aee4c518d2a5efce43f5d0973f8523db34fb.zip
.zip

Password: infected
CCSearchIntegration64.exe
.exe windows x64

Password: infected

bed042fa41e4f40ce5d4f2fdc0fc99a1

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:f4:3a:de:b1:81:12:93:c2:d9:4a:39:7b:2f:e9:58
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-01-2021 00:00

Not After

09-02-2023 23:59

Subject

CN=ControlCase LLC,OU=Product Engineering,O=ControlCase LLC,L=Fairfax,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:ef:44:1b:74:24:08:14:36:5f:09:c0:85:34:ee:a5:c9:1a:19:4f
Signer

Actual PE Digest

6f:ef:44:1b:74:24:08:14:36:5f:09:c0:85:34:ee:a5:c9:1a:19:4f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=ControlCase LLC,OU=Product Engineering,O=ControlCase LLC,L=Fairfax,ST=Virginia,C=US

01-12-2022 14:34
Valid: true

Chain 1

CN=ControlCase LLC,OU=Product Engineering,O=ControlCase LLC,L=Fairfax,ST=Virginia,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetConsoleTitleA
GetLastError
SetLastError
GetVersionExA
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext

user32

MessageBoxA

msvcrt

strncpy
_iob
atol
getenv
exit
_rmdir
_mkdir
_read
_getpid
_open
_stat
_lseek
_write
__C_specific_handler
_XcptFilter
_c_exit
_exit
_cexit
_errno
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
malloc
calloc
free
sscanf
vsprintf
sprintf
printf
remove
strstr
__initenv
fflush
_close
memcmp
memset

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

bed042fa41e4f40ce5d4f2fdc0fc99a1

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:f4:3a:de:b1:81:12:93:c2:d9:4a:39:7b:2f:e9:58Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

6f:ef:44:1b:74:24:08:14:36:5f:09:c0:85:34:ee:a5:c9:1a:19:4fSigner

Signature Validations

Verification

01-12-2022 14:34 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 552B

.rsrc Size: 4KB - Virtual size: 4KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:f4:3a:de:b1:81:12:93:c2:d9:4a:39:7b:2f:e9:58
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

6f:ef:44:1b:74:24:08:14:36:5f:09:c0:85:34:ee:a5:c9:1a:19:4f
Signer

01-12-2022 14:34
Valid: true

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 552B

.rsrc
Size: 4KB - Virtual size: 4KB