OnlineSetup[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

OnlineSetup.rar
Size

715KB
MD5

73b1b83ff2efeb6a3c1b2fd80c9d1559
SHA1

d6a60d222bde646f8c43e26d06a4631af95fa4cd
SHA256

b93a9a30e96afbd8bd704c5f868499931ef12e7f71cb1b9daf29e6b96f1260c3
SHA512

54eed68bcff862cbcc96f7e3f30c3e92fe4ee491fa44e49b7bf15eabd3607e146e180384b2460060d3ae58b02cb04c01ebc19f257d2c32bf0dd58d5c4fbc543e
SSDEEP

12288:WOV8hrnjDR3HMMiQCV/li7gUcqOqfBA16APBwnHHw8d8pmJNmxW25dv5x2WzIu9n:s9jhMEml8lHHXdnw8Wpmjf25dv5x2WMq

Score

1^/10

Malware Config

Signatures

Files

OnlineSetup.rar
.rar

Password: 123456789987654321
IF YOU NEED HELP.txt
setup_online.exe
.exe windows x86

Password: 123456789987654321

b81caf9645c283582db7fbe3519ee19d

Code Sign

7f:24:5f:80:47:fe:cd:65
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

25/05/2021, 00:00

Not After

25/05/2024, 00:00

Subject

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

20:90:4a:15:1c:28:64:55
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

11/04/2023, 00:00

Not After

11/04/2028, 00:00

Subject

CN=OnlineSetup,O=OnlineSetup,L=New-York,C=US,1.2.840.113549.1.9.1=#0c174f6e6c696e65536574757040636f6d70616e792e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:24:5f:80:47:fe:cd:65
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

25/05/2021, 00:00

Not After

25/05/2024, 00:00

Subject

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

20:90:4a:15:1c:28:64:55
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

11/04/2023, 00:00

Not After

11/04/2028, 00:00

Subject

CN=OnlineSetup,O=OnlineSetup,L=New-York,C=US,1.2.840.113549.1.9.1=#0c174f6e6c696e65536574757040636f6d70616e792e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:ab:56:a0:89:12:57:20:ed:59:41:95:5c:9c:8d:24:a6:89:44:d4:95:a1:e4:2d:f9:01:56:93:b2:ac:7e:cf
Signer

Actual PE Digest

5d:ab:56:a0:89:12:57:20:ed:59:41:95:5c:9c:8d:24:a6:89:44:d4:95:a1:e4:2d:f9:01:56:93:b2:ac:7e:cf

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OnlineSetup,O=OnlineSetup,L=New-York,C=US,1.2.840.113549.1.9.1=#0c174f6e6c696e65536574757040636f6d70616e792e636f6d

06/04/2023, 09:39
Valid: false

39:8a:f1:4f:61:3d:f7:29:49:dd:3d:26:f8:b3:d7:98:12:30:8b:93
Signer

Actual PE Digest

39:8a:f1:4f:61:3d:f7:29:49:dd:3d:26:f8:b3:d7:98:12:30:8b:93

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OnlineSetup,O=OnlineSetup,L=New-York,C=US,1.2.840.113549.1.9.1=#0c174f6e6c696e65536574757040636f6d70616e792e636f6d

06/04/2023, 09:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetUserDefaultLCID
AddConsoleAliasW
FindCloseChangeNotification
BackupSeek
FreeEnvironmentStringsA
GetModuleHandleW
EnumCalendarInfoExW
VirtualFree
ConvertFiberToThread
ReadConsoleW
EnumTimeFormatsW
EnumResourceTypesA
SetHandleCount
LoadLibraryW
SetCommConfig
GetConsoleWindow
GetVersionExW
GetFileAttributesW
EnumSystemLocalesA
InterlockedExchange
GetProfileIntA
SetThreadLocale
GetCPInfoExW
QueryPerformanceCounter
GetLastError
GetProcAddress
VirtualAlloc
HeapSize
BeginUpdateResourceW
RemoveDirectoryA
LoadLibraryA
LocalAlloc
OpenEventA
PostQueuedCompletionStatus
WriteProfileSectionW
FoldStringA
EnumDateFormatsA
GetModuleHandleA
HeapSetInformation
GetConsoleTitleW
VirtualProtect
ScrollConsoleScreenBufferA
GetShortPathNameW
GetWindowsDirectoryW
DebugBreak
InterlockedDecrement
FillConsoleOutputCharacterW
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetStdHandle
GetFileType
DeleteCriticalSection
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
CloseHandle
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SetFilePointer
SetEndOfFile
GetProcessHeap
MultiByteToWideChar
ReadFile
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

gdi32

GetCharWidthA
GetCharWidthI

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 123456789987654321

Password: 123456789987654321

b81caf9645c283582db7fbe3519ee19d

Code Sign

7f:24:5f:80:47:fe:cd:65Certificate

20:90:4a:15:1c:28:64:55Certificate

Extended Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

7f:24:5f:80:47:fe:cd:65Certificate

20:90:4a:15:1c:28:64:55Certificate

Extended Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

5d:ab:56:a0:89:12:57:20:ed:59:41:95:5c:9c:8d:24:a6:89:44:d4:95:a1:e4:2d:f9:01:56:93:b2:ac:7e:cfSigner

Signature Validations

Verification

06/04/2023, 09:39 Valid: false

39:8a:f1:4f:61:3d:f7:29:49:dd:3d:26:f8:b3:d7:98:12:30:8b:93Signer

Signature Validations

Verification

06/04/2023, 09:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

Sections

.text Size: 167KB - Virtual size: 166KB

.data Size: 6KB - Virtual size: 440KB

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 8KB - Virtual size: 7KB

7f:24:5f:80:47:fe:cd:65
Certificate

20:90:4a:15:1c:28:64:55
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

7f:24:5f:80:47:fe:cd:65
Certificate

20:90:4a:15:1c:28:64:55
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

5d:ab:56:a0:89:12:57:20:ed:59:41:95:5c:9c:8d:24:a6:89:44:d4:95:a1:e4:2d:f9:01:56:93:b2:ac:7e:cf
Signer

06/04/2023, 09:39
Valid: false

39:8a:f1:4f:61:3d:f7:29:49:dd:3d:26:f8:b3:d7:98:12:30:8b:93
Signer

06/04/2023, 09:39
Valid: false

.text
Size: 167KB - Virtual size: 166KB

.data
Size: 6KB - Virtual size: 440KB

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 8KB - Virtual size: 7KB