XDR_ResponseApp_CollectFile_ID00001262_20230530T065635Z[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

XDR_ResponseApp_CollectFile_ID00001262_20230530T065635Z.7z
Size

27.6MB
MD5

3c7d9612ea1fd22d6ce7cc220f372b52
SHA1

497d16e3d8fae0d49176695de66c3dbbfe545835
SHA256

18e939297dd3f009c62f1c60bbe00c957f06b752da6c88dc8e92e082f0a1fa2f
SHA512

c7d7b7c0a0cbfc1e1ca63f57aeb292db5d30c716c31a69a12c1aa0c5536106afbe1435a52890d49c592186d7594e7eb1abdcc3039be0e935167a5060d3ed7684
SSDEEP

786432:LgZzOCxiLyRTtLisohtVbNj0rqp4IWxJM/js:09TJT4b50Wp4n0js

Score

1^/10

Malware Config

Signatures

Files

XDR_ResponseApp_CollectFile_ID00001262_20230530T065635Z.7z
.zip

Password: x3wp3hqb
setup.exe
.exe windows x64

Password: x3wp3hqb

22a71214a0c9214caa6b4dfa0b409cb5

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:8d:c5:9b:80:b3:ad:b6:e7:6b:7e:7f:ae:51:ef:76
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/08/2021, 00:00

Not After

27/09/2023, 23:59

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:8d:c5:9b:80:b3:ad:b6:e7:6b:7e:7f:ae:51:ef:76
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/08/2021, 00:00

Not After

27/09/2023, 23:59

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

17:2f:e3:6a:9b:88:ac:ed:76:0d:b8:5c:17:a3:3a:bd:0c:79:c5:bb:db:5a:f1:7b:2b:c9:b4:b1:03:bd:73:a5
Signer

Actual PE Digest

17:2f:e3:6a:9b:88:ac:ed:76:0d:b8:5c:17:a3:3a:bd:0c:79:c5:bb:db:5a:f1:7b:2b:c9:b4:b1:03:bd:73:a5

Digest Algorithm

sha256

PE Digest Matches

false

93:3f:a1:a0:da:0c:72:3e:b9:6e:80:ec:22:e3:46:4e:88:f6:b5:6d
Signer

Actual PE Digest

93:3f:a1:a0:da:0c:72:3e:b9:6e:80:ec:22:e3:46:4e:88:f6:b5:6d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetSystemMetrics

kernel32

FindResourceW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

advapi32

CryptCreateHash

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

CryptDecodeObjectEx

ws2_32

WSAWaitForMultipleEvents

bcrypt

BCryptGenRandom

oleaut32

SysStringLen

Sections

.text
Size: - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rotk0
Size: - Virtual size: 20.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotk1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rotk2
Size: 33.6MB - Virtual size: 33.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: x3wp3hqb

Password: x3wp3hqb

22a71214a0c9214caa6b4dfa0b409cb5

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:8d:c5:9b:80:b3:ad:b6:e7:6b:7e:7f:ae:51:ef:76Certificate

Extended Key Usages

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:8d:c5:9b:80:b3:ad:b6:e7:6b:7e:7f:ae:51:ef:76Certificate

Extended Key Usages

Key Usages

17:2f:e3:6a:9b:88:ac:ed:76:0d:b8:5c:17:a3:3a:bd:0c:79:c5:bb:db:5a:f1:7b:2b:c9:b4:b1:03:bd:73:a5Signer

93:3f:a1:a0:da:0c:72:3e:b9:6e:80:ec:22:e3:46:4e:88:f6:b5:6dSigner

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

Sections

.text Size: - Virtual size: 638KB

.rdata Size: - Virtual size: 180KB

.data Size: - Virtual size: 10KB

.pdata Size: - Virtual size: 22KB

_RDATA Size: - Virtual size: 348B

.rotk0 Size: - Virtual size: 20.4MB

.rotk1 Size: 4KB - Virtual size: 3KB

.rotk2 Size: 33.6MB - Virtual size: 33.6MB

.reloc Size: 512B - Virtual size: 60B

.rsrc Size: 15KB - Virtual size: 15KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:8d:c5:9b:80:b3:ad:b6:e7:6b:7e:7f:ae:51:ef:76
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:8d:c5:9b:80:b3:ad:b6:e7:6b:7e:7f:ae:51:ef:76
Certificate

17:2f:e3:6a:9b:88:ac:ed:76:0d:b8:5c:17:a3:3a:bd:0c:79:c5:bb:db:5a:f1:7b:2b:c9:b4:b1:03:bd:73:a5
Signer

93:3f:a1:a0:da:0c:72:3e:b9:6e:80:ec:22:e3:46:4e:88:f6:b5:6d
Signer

.text
Size: - Virtual size: 638KB

.rdata
Size: - Virtual size: 180KB

.data
Size: - Virtual size: 10KB

.pdata
Size: - Virtual size: 22KB

_RDATA
Size: - Virtual size: 348B

.rotk0
Size: - Virtual size: 20.4MB

.rotk1
Size: 4KB - Virtual size: 3KB

.rotk2
Size: 33.6MB - Virtual size: 33.6MB

.reloc
Size: 512B - Virtual size: 60B

.rsrc
Size: 15KB - Virtual size: 15KB