202305061849354575 杜云若综拓经理简历[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

202305061849354575 杜云若综拓经理简历.zip
Size

8.7MB
MD5

276e6efa794948ce9fce6a5be71a7cfd
SHA1

81bca5980224c8678a8b28b0f54f79636d2cef68
SHA256

3892ecae4605e93b649461c4b313364f4df65f446e46c38132d53994a8d4cfc7
SHA512

c32e124736a15dc5fd501cf651b860ef02cf4300e203d8cc64fddfe76f88d5b5d0ccbb5ddd7c7f0ace9d3baa56709ca03482b5e54deaa9e3618b3d626896a74c
SSDEEP

196608:Te/lWpemlh08ynLqkdl8HTnDSIfq0qj38bwkF4kU:Te/WXxyLv8HPTLcMTU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/202305061849354575 杜云若综拓经理简历/WzComAddrBook64.dll

Files

202305061849354575 杜云若综拓经理简历.zip
.zip

Password: infected
202305061849354575 杜云若综拓经理简历/1.dat
202305061849354575 杜云若综拓经理简历/202305061849354575 杜云若综拓经理简历.exe
.exe windows x64

7329742c45e9b9de745211b62b13371a

Code Sign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2019, 00:00

Not After

23/05/2022, 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2019, 00:00

Not After

23/05/2022, 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:a1:66:76:a0:41:06:88:27:20:9e:68:e6:49:a7:38:b5:a2:0b:d4:8b:53:d6:7a:9b:d6:6c:86:a9:8d:83:9f
Signer

Actual PE Digest

1f:a1:66:76:a0:41:06:88:27:20:9e:68:e6:49:a7:38:b5:a2:0b:d4:8b:53:d6:7a:9b:d6:6c:86:a9:8d:83:9f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

18/08/2021, 14:48
Valid: true

Chain 1

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

a3:2b:cb:76:00:4d:3e:67:bd:59:0f:a1:79:45:09:4a:eb:f2:25:57
Signer

Actual PE Digest

a3:2b:cb:76:00:4d:3e:67:bd:59:0f:a1:79:45:09:4a:eb:f2:25:57

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

18/08/2021, 14:48
Valid: true

Chain 1

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathRemoveFileSpecW

kernel32

VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
SetLastError
GetSystemDirectoryW
GetWindowsDirectoryW
WaitForSingleObjectEx
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetFileType
SetFilePointerEx
WriteFile
QueryPerformanceCounter
CreateEventA
ResetEvent
GetCurrentProcessId
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
GetConsoleMode
GetConsoleCP
SetStdHandle
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetCPInfo
FreeLibrary
LocalFree
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
SetEvent
GetLastError
CreateMutexW
GetUserDefaultUILanguage
GetModuleFileNameW
GetCommandLineW
SwitchToThread
HeapAlloc
HeapFree
HeapSize
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleHandleExW
WriteConsoleW
ExitProcess

user32

PostQuitMessage
LoadCursorW
LoadIconW
CreateWindowExW
GetMessageW
DefWindowProcW
PostMessageW
RegisterClassExW
DispatchMessageW
TranslateMessage

advapi32

RegSetValueExW
RegOpenKeyW
RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
202305061849354575 杜云若综拓经理简历/WzComAddrBook64.dll
.dll windows x64

93e226dac83bcc8432eda7921d99281d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateToolhelp32Snapshot
GetLastError
Process32NextW
CreateFileA
Process32FirstW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetFileSize
VirtualAlloc
ReadFile
CloseHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
CreateFileW
RtlUnwind

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
202305061849354575 杜云若综拓经理简历/wzc.dat
202305061849354575 杜云若综拓经理简历/杜云若生活照.png
.png

Sharing

General

Malware Config

Signatures

Files

Password: infected

7329742c45e9b9de745211b62b13371a

Code Sign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

1f:a1:66:76:a0:41:06:88:27:20:9e:68:e6:49:a7:38:b5:a2:0b:d4:8b:53:d6:7a:9b:d6:6c:86:a9:8d:83:9fSigner

Signature Validations

Verification

18/08/2021, 14:48 Valid: true

Chain 1

a3:2b:cb:76:00:4d:3e:67:bd:59:0f:a1:79:45:09:4a:eb:f2:25:57Signer

Signature Validations

Verification

18/08/2021, 14:48 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 148KB - Virtual size: 147KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 6KB - Virtual size: 11KB

.pdata Size: 10KB - Virtual size: 9KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 3KB - Virtual size: 2KB

93e226dac83bcc8432eda7921d99281d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 128KB - Virtual size: 127KB

.rdata Size: 83KB - Virtual size: 83KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 3KB - Virtual size: 3KB

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

1f:a1:66:76:a0:41:06:88:27:20:9e:68:e6:49:a7:38:b5:a2:0b:d4:8b:53:d6:7a:9b:d6:6c:86:a9:8d:83:9f
Signer

18/08/2021, 14:48
Valid: true

a3:2b:cb:76:00:4d:3e:67:bd:59:0f:a1:79:45:09:4a:eb:f2:25:57
Signer

18/08/2021, 14:48
Valid: true

.text
Size: 148KB - Virtual size: 147KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 6KB - Virtual size: 11KB

.pdata
Size: 10KB - Virtual size: 9KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 128KB - Virtual size: 127KB

.rdata
Size: 83KB - Virtual size: 83KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 3KB - Virtual size: 3KB