NPS5_2023-02-05_14_11_35[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

NPS5_2023-02-05_14_11_35.zip
Size

91KB
MD5

31ab619b85ada782cbeeab7fcc7182c8
SHA1

69afec96ab01ab88a439f501bb3b616bf7037854
SHA256

ccac8007666e094f6afa70807b1ec7472481c80c7b479353c827a560e5dee78e
SHA512

295f9769f0bfaee501664e8431313081726458228025fc57ecf02a99922d819ab585a410f6e3390b6fc223306a873f0a1bd47562e964bbdad4897139afc3f753
SSDEEP

1536:NNFkCMCcvskn33UuIOI1vqFnomKoRSb3Gm1ZGQa9UYe5kpztUHxwvFRp4eQsiZfR:WDPUuMZqFoKBQuheYzqHxwR4vZeQ

Score

1^/10

Malware Config

Signatures

Files

NPS5_2023-02-05_14_11_35.zip
.zip

Password: Malware123!!
Device/HarddiskVolume4/StaffHome/petersonl/Archive/Application Data/FA/fa_rss.exe
.exe windows x86

Password: Malware123!!

b166f82d434fec4e0b63c22e68b29afc

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:e2:ae:d6:d6:a5:03:f0
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

20-05-2019 16:39

Not After

20-05-2020 15:51

Subject

CN=Fast Corporate LTD,O=Fast Corporate LTD,L=Kfar Saba,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

85:fb:77:b2:e1:59:11:97
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

17-09-2019 07:00

Not After

17-09-2024 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:e2:ae:d6:d6:a5:03:f0
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

20-05-2019 16:39

Not After

20-05-2020 15:51

Subject

CN=Fast Corporate LTD,O=Fast Corporate LTD,L=Kfar Saba,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:fb:77:b2:e1:59:11:97
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

17-09-2019 07:00

Not After

17-09-2024 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bf:35:86:17:4e:75:1b:bf:7e:46:a4:a5:6b:26:c4:86:61:33:90:03:28:bf:68:0a:94:11:4c:c9:f0:6c:15:ab
Signer

Actual PE Digest

bf:35:86:17:4e:75:1b:bf:7e:46:a4:a5:6b:26:c4:86:61:33:90:03:28:bf:68:0a:94:11:4c:c9:f0:6c:15:ab

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Fast Corporate LTD,O=Fast Corporate LTD,L=Kfar Saba,C=IL

18-02-2020 23:27
Valid: true

Chain 1

CN=Fast Corporate LTD,O=Fast Corporate LTD,L=Kfar Saba,C=IL

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

76:05:34:5e:79:f6:40:2f:a1:6d:d2:19:e1:06:e9:30:8b:ed:27:81
Signer

Actual PE Digest

76:05:34:5e:79:f6:40:2f:a1:6d:d2:19:e1:06:e9:30:8b:ed:27:81

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Fast Corporate LTD,O=Fast Corporate LTD,L=Kfar Saba,C=IL

18-02-2020 23:27
Valid: true

Chain 1

CN=Fast Corporate LTD,O=Fast Corporate LTD,L=Kfar Saba,C=IL

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileW

kernel32

Process32FirstW
Process32NextW
CloseHandle
GetCommandLineW
LocalFree
OpenEventW
CreateEventW
MultiByteToWideChar
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
InitializeCriticalSectionEx
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
ExitThread
CreateToolhelp32Snapshot
LoadLibraryExW
WriteConsoleW
SetEndOfFile
CreateFileW
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
GetConsoleMode
ReadFile
Sleep
FreeLibraryAndExitThread
DeleteFileW
GetTickCount
GlobalFree
GlobalAlloc
ResumeThread
CreateThread
GetFileType
LCMapStringW
CompareStringW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
GetModuleHandleExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
RtlUnwind

user32

KillTimer
GetClientRect
SetWindowLongW
SystemParametersInfoW
TranslateMessage
SetTimer
DispatchMessageW
PostQuitMessage
UpdateWindow
wsprintfW
ShowWindow
GetWindowThreadProcessId
WindowFromPoint
GetPhysicalCursorPos
GetAsyncKeyState
GetSystemMetrics
GetWindowLongW
GetMessageW
DefWindowProcW
PostMessageW
DestroyWindow
SetWindowPos
MessageBoxW
CreateWindowExW
RegisterClassExW

advapi32

RegSetKeyValueW
RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CoGetClassObject
OleUninitialize
OleSetContainedObject
OleInitialize
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: Malware123!!

Password: Malware123!!

b166f82d434fec4e0b63c22e68b29afc

Code Sign

07Certificate

Key Usages

07Certificate

Key Usages

ea:e2:ae:d6:d6:a5:03:f0Certificate

Extended Key Usages

Key Usages

85:fb:77:b2:e1:59:11:97Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

ea:e2:ae:d6:d6:a5:03:f0Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

85:fb:77:b2:e1:59:11:97Certificate

Extended Key Usages

Key Usages

bf:35:86:17:4e:75:1b:bf:7e:46:a4:a5:6b:26:c4:86:61:33:90:03:28:bf:68:0a:94:11:4c:c9:f0:6c:15:abSigner

Signature Validations

Verification

18-02-2020 23:27 Valid: true

Chain 1

76:05:34:5e:79:f6:40:2f:a1:6d:d2:19:e1:06:e9:30:8b:ed:27:81Signer

Signature Validations

Verification

18-02-2020 23:27 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

urlmon

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 111KB - Virtual size: 110KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 3KB - Virtual size: 38KB

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 6KB - Virtual size: 5KB

07
Certificate

07
Certificate

ea:e2:ae:d6:d6:a5:03:f0
Certificate

85:fb:77:b2:e1:59:11:97
Certificate

07
Certificate

ea:e2:ae:d6:d6:a5:03:f0
Certificate

07
Certificate

85:fb:77:b2:e1:59:11:97
Certificate

bf:35:86:17:4e:75:1b:bf:7e:46:a4:a5:6b:26:c4:86:61:33:90:03:28:bf:68:0a:94:11:4c:c9:f0:6c:15:ab
Signer

18-02-2020 23:27
Valid: true

76:05:34:5e:79:f6:40:2f:a1:6d:d2:19:e1:06:e9:30:8b:ed:27:81
Signer

18-02-2020 23:27
Valid: true

.text
Size: 111KB - Virtual size: 110KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 3KB - Virtual size: 38KB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 6KB - Virtual size: 5KB