XS-FlingTraaiiner[.]274205[.]tar[.]gz

Resubmissions

19/08/2023, 11:50

230819-nz3vsahe73 10

19/08/2023, 10:05

230819-l41vwaae6z 10

Sharing

Copy URL Twitter E-mail

General

Target

XS-FlingTraaiiner.274205.tar.gz
Size

306KB
MD5

8bb4b0c742ec443f5181c4f7dc6bba03
SHA1

04ac2fab737ef374c1f7daa2630cc70f40638cf3
SHA256

16fe58597feba3fb62be54da7e2c4eb58a825a9db72f1db0003ed7dd3a065938
SHA512

8d3acfec0019d2977346f7ab283c23ee354ae8237a643aec63957b727a980118a0f5148c98ecbdd0926326ef40ad45bcaefae66fa8350b21571b6eac4d2d6d14
SSDEEP

6144:2gBfQ4tDkQV14NOwS9KmHELEw7GXAPDy5WNYYyvMiUajzLAMw/Igg1Og:2C44tDn4ML9KhL3CwPreYniUSzL2/Igu

Score

1^/10

Malware Config

Signatures

Files

XS-FlingTraaiiner.274205.tar.gz
.gz
XS-FlingTraaiiner.274205.tar
.tar
XS-FlingTraaiiner.274205.exe
.exe windows x64

af31c1efceb0dcf22791a6441ebceec0

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:f2:69:9b:cc:0b:78:43:15:69:84:e1:12:e0:a4:2a
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/10/2020, 00:00

Not After

02/11/2023, 12:00

Subject

CN=Evernote Corporation,O=Evernote Corporation,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:f2:69:9b:cc:0b:78:43:15:69:84:e1:12:e0:a4:2a
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/10/2020, 00:00

Not After

02/11/2023, 12:00

Subject

CN=Evernote Corporation,O=Evernote Corporation,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:ed:98:c7:76:ce:75:23:5f:ae:cf:f2:1a:9f:e7:50:20:e5:8e:6d:04:90:ce:3f:d5:75:d8:17:5b:b0:57:bc
Signer

Actual PE Digest

6e:ed:98:c7:76:ce:75:23:5f:ae:cf:f2:1a:9f:e7:50:20:e5:8e:6d:04:90:ce:3f:d5:75:d8:17:5b:b0:57:bc

Digest Algorithm

sha256

PE Digest Matches

false

ac:01:4d:21:32:f4:e9:77:65:97:07:aa:61:96:e2:20:d0:3d:92:e1
Signer

Actual PE Digest

ac:01:4d:21:32:f4:e9:77:65:97:07:aa:61:96:e2:20:d0:3d:92:e1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentProcessId
GetProcAddress
LoadLibraryW
GetCommandLineA
GetCurrentDirectoryA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
TryEnterCriticalSection
lstrcmpA
GetCurrentThreadId
GetTickCount
lstrcmpiA
DeleteCriticalSection
Sleep
InitializeCriticalSection
LeaveCriticalSection
OutputDebugStringA
EnterCriticalSection
CreateEventA
ResetEvent
CreateThread
WaitForSingleObject
SetEvent
LocalFree
EncodePointer
DecodePointer
InitializeCriticalSectionEx
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteFile
CreateFileW
GetLastError
lstrcmpiW
SizeofResource
GetFullPathNameW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
OpenFileMappingW
ResumeThread
UnmapViewOfFile
CreateEventW
LockResource
FindResourceExW
LoadResource
CreateSemaphoreW
CreateFileMappingW
MapViewOfFile
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
RaiseException
CloseHandle
WaitForMultipleObjects

gdi32

PolyPolygon
CreateHatchBrush
Polygon
GetTextMetricsA
CreateFontA
TextOutW
TextOutA
SetTextAlign
BitBlt
CreateDIBSection
CreateCompatibleDC
GetTextExtentExPointA
Rectangle
Pie
Ellipse
GetTextExtentPoint32A
PatBlt
CreateRectRgn
LineTo
CreateFontIndirectA
MoveToEx
SelectObject
CreateBrushIndirect
SetBkColor
SetDCPenColor
CreateSolidBrush
DeleteObject
SetBkMode
CreatePen
GetStockObject

user32

SwitchToThisWindow
GetWindowInfo
TranslateAcceleratorA
GetSubMenu
DialogBoxParamA
MessageBeep
EndDialog
LoadStringA
MessageBoxW
GetMenu
GetMessageA
LoadMenuA
GetWindowDC
SetWindowLongPtrA
GetWindowLongPtrA
SetClipboardData
GetMonitorInfoA
EmptyClipboard
CloseClipboard
OpenClipboard
GetSystemMetrics
MonitorFromWindow
UnregisterClassA
ModifyMenuA
SendMessageW
SetScrollInfo
GetKeyState
GetWindowRect
GetDC
SetWindowPos
FillRect
ScreenToClient
GetScrollInfo
RedrawWindow
GetDlgCtrlID
ClientToScreen
RegisterClassA
SetDlgItemTextW
GetDlgItemTextW
MessageBoxA
GetSysColor
MoveWindow
IsDlgButtonChecked
DefWindowProcA
CreateWindowExA
ScrollWindowEx
GetDlgItemInt
GetClientRect
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
CallNextHookEx
GetDlgItemTextA
SetWindowsHookExA
UnhookWindowsHookEx
SetDlgItemTextA
GetDlgItem
EnableWindow
LoadCursorA
PostMessageA
SendMessageA
SetCursor
CheckDlgButton
SetDlgItemInt
DispatchMessageA
DestroyWindow
MsgWaitForMultipleObjects
ShowWindow
IsWindow
IsDialogMessageA
GetWindowTextA
SetWindowTextA
TranslateMessage
DestroyMenu
DrawMenuBar
CreateDialogParamA
PeekMessageA
LoadAcceleratorsA
SetScrollRange
LoadIconA
TrackPopupMenuEx
RemoveMenu
CheckMenuItem
PostQuitMessage
SetScrollPos
EnableMenuItem
InsertMenuItemA
UpdateWindow
RegisterClassExA
IsCharAlphaNumericW
GetCursorPos
SetForegroundWindow
SetFocus

msvcrt

__crtLCMapStringA
_wsetlocale
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_acmdln
_fmode
_commode
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_wcsdup
memset
??3@YAXPEAX@Z
__CxxFrameHandler3
_purecall
swprintf_s
abort
_ismbblead
___mb_cur_max_func
__uncaught_exception
islower
calloc
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
fseek
_fsopen
setlocale
_unlock
_lock
memmove
memcpy
_CxxThrowException
_callnewh
malloc
_i64toa_s
localeconv
strcspn
sprintf_s
wcsrchr
strstr
_wcsupr_s
wcsstr
wcscat_s
mbstowcs
sscanf_s
_strtoui64
wcstombs
swscanf_s
strtod
_strtoi64
_vsnwprintf
vsprintf_s
_wcsicmp
_fseeki64
fsetpos
ungetc
free
fgetpos
fwrite
??0exception@@QEAA@AEBQEBD@Z
fgetc
_vsnprintf
fclose
_wtoi
vswprintf_s
_vscwprintf
_wcslwr_s
memmove_s
fflush
memcpy_s
fputc
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_scwprintf
setvbuf

comdlg32

GetSaveFileNameA
GetOpenFileNameW

msimg32

GradientFill

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

oleaut32

SysFreeString
SysAllocString

shell32

ShellExecuteA

comctl32

ord17

rpcrt4

UuidFromStringA

Sections

.text
Size: 400KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

af31c1efceb0dcf22791a6441ebceec0

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:f2:69:9b:cc:0b:78:43:15:69:84:e1:12:e0:a4:2aCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:f2:69:9b:cc:0b:78:43:15:69:84:e1:12:e0:a4:2aCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

6e:ed:98:c7:76:ce:75:23:5f:ae:cf:f2:1a:9f:e7:50:20:e5:8e:6d:04:90:ce:3f:d5:75:d8:17:5b:b0:57:bcSigner

ac:01:4d:21:32:f4:e9:77:65:97:07:aa:61:96:e2:20:d0:3d:92:e1Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comdlg32

msimg32

ntdll

oleaut32

shell32

comctl32

rpcrt4

Sections

.text Size: 400KB - Virtual size: 396KB

.rdata Size: 116KB - Virtual size: 114KB

.data Size: 12KB - Virtual size: 20KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 156KB - Virtual size: 155KB

.reloc Size: 4KB - Virtual size: 2KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:f2:69:9b:cc:0b:78:43:15:69:84:e1:12:e0:a4:2a
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:f2:69:9b:cc:0b:78:43:15:69:84:e1:12:e0:a4:2a
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6e:ed:98:c7:76:ce:75:23:5f:ae:cf:f2:1a:9f:e7:50:20:e5:8e:6d:04:90:ce:3f:d5:75:d8:17:5b:b0:57:bc
Signer

ac:01:4d:21:32:f4:e9:77:65:97:07:aa:61:96:e2:20:d0:3d:92:e1
Signer

.text
Size: 400KB - Virtual size: 396KB

.rdata
Size: 116KB - Virtual size: 114KB

.data
Size: 12KB - Virtual size: 20KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 156KB - Virtual size: 155KB

.reloc
Size: 4KB - Virtual size: 2KB