eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.zip
- SHA256 021ac9cff2c1219c8057bb7f7d75ad8a06676b459a4bcf5c2d765f8efecfd016
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.zip
- Size 555KB
- Sample230107-2a3elseh76
- SHA256 021ac9cff2c1219c8057bb7f7d75ad8a06676b459a4bcf5c2d765f8efecfd016
- MD5 bfc0d273f125755c8e751d875dec7aec
- SHA1 014624e567d36e140eda5fd26e03fa23c711c169
- SHA512 d529e92bdce193174577fe9829ef2dbfd8f0c7abb300b46eae2273b7e9b64f77a709bd0dbc3102dd7aecd801bbaf446aab4b96cdca0a79ccdbf72636e69bba8f
- SSDEEP 12288:A82ju2T3b6kF4LNCYJmG4XBhZGH8LxZ6792NqR:ATZ6k2QfG8mH97R
- MD5 SHA1 SHA512 SSDEEP
Score
N/A
Malware Config
Signatures
File Explorer
-
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.zip.zip 555KB
-
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe.exe 1.2MB
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
- IMPHASH 5ac063140bb65ee6bf5852bb45b1e9b6
- SHA256 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0
- MD5 16bcc3b7f32c41e7c7222bf37fe39fe6
- SHA1 a25bc5442c86bdeb0dec6583f0e80e241745fb73
- SHA512 f3e7087f569b3bcc201c006c5dfcea6cf560cad480bc03e6f17790190bc35bf6659e91a9f91219952bd139a3c9afde961032ee1d0861158409206feaa6540f9e
- SSDEEP 24576:uj/6CtkHRos9l+zan4Q6eQqF5ZgQibE2zkMiJHic9OuTw258tox6T9G0SKoRl:A/NtkHRos9l+zan4QTB/2zkPtBq2itoP
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
6d:00:54:dc:32:61:66:87:d9:db:bc:3c:fe:71:48:be:15:77:51:b9:bd:fe:55:ac:e2:1a:7a:a4:6d:d3:2b:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Subject
CN=ALISA LTD,O=ALISA LTD,POSTALCODE=WC2H 9JQ,STREET=71-75 Shelton Street Covent Garden,L=LONDON,ST=LONDON,C=GB
Serial Number
5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2019 - Feb 21, 2020
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 30, 2000 - May 30, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Minor OS version
Major OS version
Entry point
631852
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
shlwapi
PathIsNetworkPathA
kernel32
OutputDebugStringA
InterlockedDecrement
TerminateProcess
WaitForSingleObject
GetCurrentThreadId
GetSystemDirectoryW
FreeEnvironmentStringsW
DuplicateHandle
GetModuleHandleA
OpenProcess
GetLogicalDriveStringsW
MultiByteToWideChar
Sleep
FormatMessageW
Wow64RevertWow64FsRedirection
GetLastError
SetEvent
TlsAlloc
WaitForSingleObjectEx
CloseHandle
GetSystemInfo
HeapAlloc
GetWindowsDirectoryW
GetProcAddress
LocalFree
GetCurrentProcessId
GetProcessHeap
CreateProcessW
FreeLibrary
WideCharToMultiByte
CreateProcessA
GetSystemTimeAsFileTime
InterlockedIncrement
TlsFree
FormatMessageA
CreateEventA
GetTickCount
GetEnvironmentStringsW
GetDriveTypeW
Wow64DisableWow64FsRedirection
GetExitCodeProcess
GetFileAttributesExW
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
DeviceIoControl
GetModuleHandleW
MoveFileExW
SetLastError
GetCurrentThread
GetThreadTimes
QueryPerformanceCounter
QueryPerformanceFrequency
SetStdHandle
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
HeapSize
ReleaseSemaphore
GetCurrentProcess
GetCommandLineW
HeapFree
MapViewOfFileEx
OpenFileMappingA
CreateFileMappingA
SwitchToThread
UnmapViewOfFile
InterlockedExchange
AreFileApisANSI
WriteConsoleW
LoadLibraryExW
SetEnvironmentVariableA
GetOEMCP
GetExitCodeThread
GetNativeSystemInfo
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsGetValue
TlsSetValue
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleFileNameW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
RaiseException
GetCommandLineA
ExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
WriteFile
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
IsValidCodePage
shell32
SHGetFolderPathW
SHGetFileInfoW
ole32
CoCreateInstance
CoInitialize
CoUninitialize
advapi32
ControlService
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
EnumDependentServicesW
OpenProcessToken
OpenServiceW
QueryServiceStatusEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ws2_32
WSACleanup
WSAStartup
Name
.text
Size
914KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
210KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ