1e13c8a7c2b89db3cf0f5d84ae88f5a6a12ca10c4673ad0297dfde1445626d0d[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

1e13c8a7c2b89db3cf0f5d84ae88f5a6a12ca10c4673ad0297dfde1445626d0d.zip
Size

5.0MB
MD5

0c62b6e4e0321b47a67272888c85e492
SHA1

3ba59b3e7b21f8efdcdd263bd1c946102517064e
SHA256

dcb2548dab85ff6be55030e534267cbd9885b22cd32fa37690fe51935206c942
SHA512

d50c19daba08a943e601217eecdf7d7c6dc098ab1c4fc534be4e1ddf070de43f89f6826a3571bdb894e397758e532841cd602a41b0f8fda0e1ee469e6d7b4261
SSDEEP

98304:aMYN7Gu3jnFE8b38YLWsmcnwcoi6+iwqRJfQqX90OjBxDj+iXW+kzahA9k/4dipk:aHEALpbnOiwBfNX9zxGim+kMSk/40a

Score

1^/10

Malware Config

Signatures

Files

1e13c8a7c2b89db3cf0f5d84ae88f5a6a12ca10c4673ad0297dfde1445626d0d.zip
.zip

Password: infected
1e13c8a7c2b89db3cf0f5d84ae88f5a6a12ca10c4673ad0297dfde1445626d0d.exe
.exe windows x86

Password: infected

c7c88a9f12777d4c1f156ccc8f276fa1

Code Sign

2f:db:9d:8a:7f:44:21:84:4e:02:cc:0d:6b:19:a9:1e
Certificate

Issuer

CN=www.during.com

Not Before

02/02/2023, 13:36

Not After

02/02/2024, 13:56

Subject

CN=www.during.com

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

eb:5c:5a:8b:18:f0:1c:0e:e3:4f:1a:fa:15:32:f9:de:e0:6d:45:3e:25:a1:6d:b1:58:e8:2e:62:e1:63:51:c4
Signer

Actual PE Digest

eb:5c:5a:8b:18:f0:1c:0e:e3:4f:1a:fa:15:32:f9:de:e0:6d:45:3e:25:a1:6d:b1:58:e8:2e:62:e1:63:51:c4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=www.during.com

02/02/2023, 14:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AcquireSRWLockExclusive
CreateEventA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

oleaut32

GetErrorInfo

user32

GetForegroundWindow
CharUpperBuffW

bcrypt

BCryptGenRandom

msvcrt

__dllonexit

Sections

.text
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wkv
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.a?a
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Sk^
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

c7c88a9f12777d4c1f156ccc8f276fa1

Code Sign

2f:db:9d:8a:7f:44:21:84:4e:02:cc:0d:6b:19:a9:1eCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

eb:5c:5a:8b:18:f0:1c:0e:e3:4f:1a:fa:15:32:f9:de:e0:6d:45:3e:25:a1:6d:b1:58:e8:2e:62:e1:63:51:c4Signer

Signature Validations

Verification

02/02/2023, 14:13 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

user32

bcrypt

msvcrt

Sections

.text Size: - Virtual size: 260KB

.data Size: - Virtual size: 152B

.rdata Size: - Virtual size: 341KB

.eh_fram Size: - Virtual size: 23KB

.bss Size: - Virtual size: 1KB

.idata Size: - Virtual size: 4KB

.CRT Size: - Virtual size: 64B

.tls Size: - Virtual size: 32B

.wkv Size: - Virtual size: 2.6MB

.a?a Size: 1KB - Virtual size: 1KB

.Sk^ Size: 5.1MB - Virtual size: 5.1MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 304KB - Virtual size: 303KB

2f:db:9d:8a:7f:44:21:84:4e:02:cc:0d:6b:19:a9:1e
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

eb:5c:5a:8b:18:f0:1c:0e:e3:4f:1a:fa:15:32:f9:de:e0:6d:45:3e:25:a1:6d:b1:58:e8:2e:62:e1:63:51:c4
Signer

02/02/2023, 14:13
Valid: false

.text
Size: - Virtual size: 260KB

.data
Size: - Virtual size: 152B

.rdata
Size: - Virtual size: 341KB

.eh_fram
Size: - Virtual size: 23KB

.bss
Size: - Virtual size: 1KB

.idata
Size: - Virtual size: 4KB

.CRT
Size: - Virtual size: 64B

.tls
Size: - Virtual size: 32B

.wkv
Size: - Virtual size: 2.6MB

.a?a
Size: 1KB - Virtual size: 1KB

.Sk^
Size: 5.1MB - Virtual size: 5.1MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 304KB - Virtual size: 303KB