ZAHLUNG170423[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ZAHLUNG170423.exe
Size

634KB
MD5

57bdffa5ada380fd8ab677a2148e4e7f
SHA1

1c8474d9896899465cc7a4ed4ea39115f25fc55a
SHA256

9fa9491a8681ec5a9037a9dd27f8e80e74b23a5518ac7c5891ce0d7114bbd95e
SHA512

7ae1fbc0be1a03fb3c9b6c14cc984c9970e5e553eeb73cc8f6f77885519caee654b4b12b6fa51d308c451a4938bf46767e8b33809e3b181a9bafe9ec3b62b20b
SSDEEP

12288:DUakRlhu/SyP01gGZ/lYWkQ8uCUQzB9gyIQ/R7ZPc4eDE+k:gTXhu/Pc1gGZ/lYTQa5zB9gYRRcY+k

Score

1^/10

Malware Config

Signatures

Files

ZAHLUNG170423.exe
.exe windows x64

Code Sign

95:be:a0:4e:6a:0d:bc:1f:1d:03:aa:d5:2a:6c:24:d2
Certificate

Issuer

CN=xerox,C=CN

Not Before

17/04/2023, 09:00

Not After

17/04/2024, 09:00

Subject

CN=xerox,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:4b:c3:5f:87:74:76:ef:e7:4b:a5:e1:79:5b:d9:65:2a:7c:65:ae:27:4e:e6:5c:b7:1a:c6:ff:57:9b:e7:18
Signer

Actual PE Digest

20:4b:c3:5f:87:74:76:ef:e7:4b:a5:e1:79:5b:d9:65:2a:7c:65:ae:27:4e:e6:5c:b7:1a:c6:ff:57:9b:e7:18

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=xerox,C=CN

13/04/2023, 18:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 626KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

95:be:a0:4e:6a:0d:bc:1f:1d:03:aa:d5:2a:6c:24:d2Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

20:4b:c3:5f:87:74:76:ef:e7:4b:a5:e1:79:5b:d9:65:2a:7c:65:ae:27:4e:e6:5c:b7:1a:c6:ff:57:9b:e7:18Signer

Signature Validations

Verification

13/04/2023, 18:12 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 626KB - Virtual size: 625KB

.rsrc Size: 2KB - Virtual size: 1KB

95:be:a0:4e:6a:0d:bc:1f:1d:03:aa:d5:2a:6c:24:d2
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

20:4b:c3:5f:87:74:76:ef:e7:4b:a5:e1:79:5b:d9:65:2a:7c:65:ae:27:4e:e6:5c:b7:1a:c6:ff:57:9b:e7:18
Signer

13/04/2023, 18:12
Valid: false

.text
Size: 626KB - Virtual size: 625KB

.rsrc
Size: 2KB - Virtual size: 1KB