General

Malware Config

Signatures

Files

• Sample.zip

  .zip

  Password: infected

• Setup_Win_19-01-2023_18-58-46.zip

  .zip

  Password: infected

• Setup_Win_19-01-2023_18-58-44.exe

  .exe windows x64

  Password: infected

  8032914dc488d45feeee4b03a67b4032

  
  

  Code Sign

  bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

  Certificate

  Issuer

  CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  19-05-2021 05:32

  Not After

  18-05-2036 05:32

  Subject

  CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6e:44:fc:ed:d4:9f:22:f7:a2:8c:ec:c9:91:04:f6:1a

  Certificate

  Issuer

  CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

  Not Before

  05-01-2023 12:56

  Not After

  05-01-2024 12:56

  Subject

  SERIALNUMBER=389470690,CN=M-Trans Maciej Caban,O=M-Trans Maciej Caban,POSTALCODE=96-100,STREET=Sucharskiego 2 lok. 31,L=Skierniewice,C=PL,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#1302504c

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30

  Certificate

  Issuer

  CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

  Not Before

  28-07-2022 08:56

  Not After

  27-07-2033 08:56

  Subject

  CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

  Certificate

  Issuer

  CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  19-05-2021 05:32

  Not After

  18-05-2036 05:32

  Subject

  CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  31-05-2021 06:43

  Not After

  17-09-2029 06:43

  Subject

  CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  83:8e:59:82:0f:49:a3:99:0e:8c:0e:40:ff:92:48:d0:93:98:1f:c0:86:fa:d1:77:ec:d7:92:05:55:f2:7a:64

  Signer

  Actual PE Digest

  83:8e:59:82:0f:49:a3:99:0e:8c:0e:40:ff:92:48:d0:93:98:1f:c0:86:fa:d1:77:ec:d7:92:05:55:f2:7a:64

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=389470690,CN=M-Trans Maciej Caban,O=M-Trans Maciej Caban,POSTALCODE=96-100,STREET=Sucharskiego 2 lok. 31,L=Skierniewice,C=PL,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#1302504c

  20-01-2023 15:46

  Valid: true

  Chain 1

  SERIALNUMBER=389470690,CN=M-Trans Maciej Caban,O=M-Trans Maciej Caban,POSTALCODE=96-100,STREET=Sucharskiego 2 lok. 31,L=Skierniewice,C=PL,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#1302504c

  CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

  CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Chain 2

  SERIALNUMBER=389470690,CN=M-Trans Maciej Caban,O=M-Trans Maciej Caban,POSTALCODE=96-100,STREET=Sucharskiego 2 lok. 31,L=Skierniewice,C=PL,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#1302504c

  CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

  CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  LCMapStringW

  HeapReAlloc

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  LoadLibraryExW

  LeaveCriticalSection

  EnterCriticalSection

  TlsFree

  TlsSetValue

  TlsGetValue

  GetProcAddress

  GetCurrentProcess

  Sleep

  InitializeCriticalSectionAndSpinCount

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlCaptureContext

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleFileNameW

  WriteFile

  GetModuleFileNameA

  GetStartupInfoW

  DeleteCriticalSection

  GetFileType

  GetStdHandle

  GetProcessHeap

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  OutputDebugStringW

  GetStringTypeW

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  CreateFileW

  TlsAlloc

  LoadLibraryW

  GetModuleHandleW

  FreeLibrary

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  TerminateProcess

  EncodePointer

  DecodePointer

  GetCommandLineA

  RtlPcToFileHeader

  RaiseException

  RtlLookupFunctionEntry

  RtlUnwindEx

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetLastError

  ExitProcess

  GetModuleHandleExW

  MultiByteToWideChar

  WideCharToMultiByte

  HeapSize

  HeapFree

  HeapAlloc

  SetLastError

  GetCurrentThreadId

  CloseHandle

  user32

  SetDlgItemTextW

  EndPaint

  DestroyWindow

  TranslateAcceleratorW

  GetWindowRect

  GetMessageW

  PostQuitMessage

  FillRect

  LoadImageW

  DrawTextW

  DialogBoxParamW

  LoadCursorW

  GetClientRect

  BeginPaint

  GetClassInfoExW

  TranslateMessage

  LoadAcceleratorsW

  GetMenu

  IsDialogMessageW

  RegisterClassExW

  LoadIconW

  MessageBoxA

  InvalidateRect

  GetWindowLongW

  EnableMenuItem

  GetMenuState

  SetWindowLongW

  EndDialog

  SetWindowPos

  CheckDlgButton

  ShowWindow

  GetSysColorBrush

  FrameRect

  CreateDialogParamW

  DrawMenuBar

  GetSystemMetrics

  MapWindowPoints

  UpdateWindow

  EnableWindow

  CheckMenuItem

  CopyRect

  MoveWindow

  DispatchMessageW

  GetWindowTextLengthW

  CloseClipboard

  EmptyClipboard

  GetDlgItem

  SendDlgItemMessageW

  IsDlgButtonChecked

  OpenClipboard

  MessageBoxW

  GetDlgItemTextW

  SendMessageW

  SetClipboardData

  gdi32

  DeleteDC

  SelectObject

  CreateCompatibleDC

  GetStockObject

  CreateSolidBrush

  SetTextColor

  SetBkColor

  SetBkMode

  DeleteObject

  TextOutW

  BitBlt

  advapi32

  RegCreateKeyExW

  RegSetValueExW

  RegCloseKey

  RegQueryValueExW

  comctl32

  ord17

  Sections

  .text

  Size: 81KB - Virtual size: 80KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 65KB - Virtual size: 65KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 7KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 32KB - Virtual size: 31KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ