tEb3hA8EyMgcfvEOHdvopo[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

tEb3hA8EyMgcfvEOHdvopo.zip
Size

3.1MB
MD5

1c25beab630cb6d37b777f7cedca34f3
SHA1

076a21c79eaa639c48e1d98e9656f55613c333d0
SHA256

5da5c6e396db2d7fedd6379c5594697edae74f9f6c43de873896f344474936fa
SHA512

3d7f5bc9807dc17f7909680d98961163906f60c02f731e3c25f4804dea54e7e9d3d02937c6046f9487a3711b56a52637943d44fa4c48331b2faa77145bf07068
SSDEEP

98304:llM4nN9TyoNASmh3UudmX4eUxh3rOIwTb75u:l7SSK7dmX7u36tdu

Score

1^/10

Malware Config

Signatures

Files

tEb3hA8EyMgcfvEOHdvopo.zip
.zip

Password: unzip-me
AdskAccessService.exe_
.exe windows x64

Password: unzip-me

a2b05cf296a02afebd766abde9831b9a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:61:b8:03:bd:89:dc:fa:71:cf:a7:f3:e8:fe:8c:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/10/2022, 00:00

Not After

14/10/2023, 23:59

Subject

CN=Autodesk\, Inc.,O=Autodesk\, Inc.,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:24:33:a8:90:e2:ba:05:a0:a2:a7:9e:7b:3a:39:27:a4:70:98:44:45:83:e1:05:93:63:b5:a0:b9:41:96:1a
Signer

Actual PE Digest

52:24:33:a8:90:e2:ba:05:a0:a2:a7:9e:7b:3a:39:27:a4:70:98:44:45:83:e1:05:93:63:b5:a0:b9:41:96:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msi

ord217
ord173

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsUNCW
PathUnquoteSpacesW
PathAppendW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSAStartup
WSACleanup
closesocket
accept
bind
connect
ntohs
ntohl
htons
htonl
FreeAddrInfoW
GetAddrInfoW
WSAWaitForMultipleEvents
WSASocketW
WSASetEvent
WSASend
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
WSASetLastError
gethostname
shutdown
setsockopt
send
recv
listen
ioctlsocket

kernel32

GetLastError
FormatMessageA
FormatMessageW
WideCharToMultiByte
LocalFree
DecodePointer
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleFileNameW
GetCurrentProcessId
FreeLibrary
GetProcAddress
SetDllDirectoryW
CreateFileW
GetFileAttributesExW
GetFileSize
ReadFile
CloseHandle
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
AreFileApisANSI
WriteFile
GetSystemDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleInformation
CreatePipe
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
TlsAlloc
TlsFree
CreateProcessA
LoadLibraryExW
GetCurrentProcess
CreateProcessW
OpenProcess
GetModuleHandleW
AddDllDirectory
LoadLibraryW
GlobalAlloc
GlobalFree
lstrcpyW
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumProcessModules
K32GetModuleFileNameExW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
GetVolumeInformationW
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetSystemInfo
SetErrorMode
GetSystemTime
SystemTimeToFileTime
GetTempPathW
SetUnhandledExceptionFilter
GetProcessTimes
GetCurrentThreadId
WriteProcessMemory
LocaleNameToLCID
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SetFileTime
LCMapStringEx
GetWindowsDirectoryW
CreateDirectoryExW
CopyFileExW
MoveFileExW
CreateEventA
SetEvent
WaitForSingleObjectEx
GetLocaleInfoA
IsValidCodePage
IsDBCSLeadByteEx
EnumSystemLocalesA
FoldStringW
LCMapStringW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetStdHandle
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
SetThreadStackGuarantee
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
VerSetConditionMask
VerifyVersionInfoW
Sleep
SwitchToThread
LockFileEx
UnlockFile
GetFileType
AllocConsole
GetConsoleMode
WriteConsoleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateFileA
ConnectNamedPipe
DisconnectNamedPipe
RtlUnwind
CancelIo
CreateEventW
CreateNamedPipeA
WaitNamedPipeA
UnlockFileEx
PeekNamedPipe
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
CompareStringEx
GetCPInfo
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
ResetEvent
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
TlsGetValue
TlsSetValue
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetConsoleCtrlHandler
SetStdHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetCommandLineA
GetCommandLineW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetFileSizeEx
ReadConsoleW
GetTimeZoneInformation
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
RtlPcToFileHeader
GetStringTypeW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
CopyFileW
SetFileInformationByHandle
GetFinalPathNameByHandleW
SetEnvironmentVariableW
HeapQueryInformation
GetACP
GetOEMCP
DeviceIoControl
GetOverlappedResult
FindNextFileW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
GetExitCodeThread
GetNativeSystemInfo
FindClose
FindFirstFileExW

user32

UnregisterClassW
GetShellWindow
EnumWindows
GetWindowThreadProcessId
ExitWindowsEx

shell32

ord51
SHCreateDirectoryExW
SHGetKnownFolderPath
SHGetFileInfoW
ShellExecuteExW

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize

advapi32

RegQueryValueExA
OpenProcessToken
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
DuplicateTokenEx
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCreateKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetLengthSid
CopySid
GetUserNameW
RegSetValueExA
CreateProcessAsUserW
RegOpenKeyExA
RegCreateKeyExA
RegGetValueW
RegOpenKeyExW
RegCloseKey
ConvertSidToStringSidW
CreateProcessWithTokenW
LookupPrivilegeValueW
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
EqualSid

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

secur32

LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSCloseServer
WTSOpenServerW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptQueryObject
CryptMsgClose

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 630KB - Virtual size: 672KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 442KB - Virtual size: 441KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
files-api.LGCTISJOA2ebPH6BKaO7BZ.xml
.xml
manifest.json
metadata.json
script.xml
.xml
sysinfo.MW5NOq1EWc4lCNciX4c4BE.xml
.xml

Sharing

General

Malware Config

Signatures

Files

Password: unzip-me

Password: unzip-me

a2b05cf296a02afebd766abde9831b9a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:61:b8:03:bd:89:dc:fa:71:cf:a7:f3:e8:fe:8c:92Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

52:24:33:a8:90:e2:ba:05:a0:a2:a7:9e:7b:3a:39:27:a4:70:98:44:45:83:e1:05:93:63:b5:a0:b9:41:96:1aSigner

Headers

DLL Characteristics

File Characteristics

Imports

msi

shlwapi

version

ws2_32

kernel32

user32

shell32

ole32

advapi32

userenv

secur32

wtsapi32

bcrypt

wintrust

crypt32

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 630KB - Virtual size: 672KB

.pdata Size: 442KB - Virtual size: 441KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 178KB - Virtual size: 178KB

.reloc Size: 58KB - Virtual size: 58KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:61:b8:03:bd:89:dc:fa:71:cf:a7:f3:e8:fe:8c:92
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

52:24:33:a8:90:e2:ba:05:a0:a2:a7:9e:7b:3a:39:27:a4:70:98:44:45:83:e1:05:93:63:b5:a0:b9:41:96:1a
Signer

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 630KB - Virtual size: 672KB

.pdata
Size: 442KB - Virtual size: 441KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 178KB - Virtual size: 178KB

.reloc
Size: 58KB - Virtual size: 58KB