49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3.zip
Size

15KB
MD5

4d6e309d9bbd337caf654c70f67f0256
SHA1

1b56259af7f4965c8aa24c913ff00d8b3fe6bd3c
SHA256

20e9f7d62d399fef42785455205b786e71ac9f26cc9bb924e7128bf473d20910
SHA512

675ebab26dc5e0e54486c740c83d1799590faf31b724233ecdb00ab31411dc8df1713ebbf3baae96d4941e7c3551520ee1aba2a1b9305c07aa4c4f453769a8de
SSDEEP

384:cgxPvrTLWBTKwofKLMFLz+kSb0Lk7RX/Zl5:cgBvvK+FLz+Lbu2tB

Score

1^/10

Malware Config

Signatures

Files

49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3.zip
.zip

Password: infected
client32.exe
.exe windows x86

78ed70ebeb178ed1bae5921d2ed514bc

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

21-09-2017 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

21-09-2017 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24
Signer

Actual PE Digest

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24

Digest Algorithm

sha256

PE Digest Matches

true

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4e
Signer

Actual PE Digest

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

pcicl32

_NSMClient32@8

kernel32

GetCommandLineA
ExitProcess
GetModuleHandleA
GetStartupInfoA

Sections

.text
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 342B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

78ed70ebeb178ed1bae5921d2ed514bc

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24Signer

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4eSigner

Headers

DLL Characteristics

File Characteristics

Imports

pcicl32

kernel32

Sections

.text Size: 512B - Virtual size: 176B

.rdata Size: 512B - Virtual size: 342B

.rsrc Size: 90KB - Virtual size: 90KB

.reloc Size: 512B - Virtual size: 108B

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24
Signer

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4e
Signer

.text
Size: 512B - Virtual size: 176B

.rdata
Size: 512B - Virtual size: 342B

.rsrc
Size: 90KB - Virtual size: 90KB

.reloc
Size: 512B - Virtual size: 108B