3c5a7c274d45c714c7c63fbb1e63a4eb5b04bc7ea296d6a705c29d38795439b0[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

3c5a7c274d45c714c7c63fbb1e63a4eb5b04bc7ea296d6a705c29d38795439b0.exe.zip
Size

17.7MB
MD5

0a35b51f12e8fef7877d58d453783f4d
SHA1

f4e560eac2684757586022bcb901ba912beb3f1a
SHA256

5f0d994422725f2b4bd6468db7a5abec529fb99afe1bf61cd09c7f681336f90d
SHA512

30d71ac8e344e216ccb4967ed18f48be2c90356a92939250d79cc8c1033ef2b4d7d2bd0bf4cde9dca0d2c176a19e5b18dc669947d944f56d33d4c461a2e3c3cd
SSDEEP

393216:KluirpyhF4g+tPuWZU4TL9ScXWbjc5ZB2ClOxSPDtCRi5h0ZfT:KluidQcpPv9Scm3c5ZB2ClOkC2eb

Score

1^/10

Malware Config

Signatures

Files

3c5a7c274d45c714c7c63fbb1e63a4eb5b04bc7ea296d6a705c29d38795439b0.exe.zip
.zip

Password: infected
3c5a7c274d45c714c7c63fbb1e63a4eb5b04bc7ea296d6a705c29d38795439b0.exe
.exe windows:5 windows x64

d35aaf46ab067e39dc24c90fe5e07bdd

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:30:23:24:82:ea:69:a8:e8:69:4b:cb
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 19:28

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 18:58

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:d8:a6:29:68:3c:8b:28:b7:64:a2:03:98:79:97:78:f0:9a:19:7e:4f:80:6a:96:fe:40:65:90:a9:76:ee:ab
Signer

Actual PE Digest

3d:d8:a6:29:68:3c:8b:28:b7:64:a2:03:98:79:97:78:f0:9a:19:7e:4f:80:6a:96:fe:40:65:90:a9:76:ee:ab

Digest Algorithm

sha256

PE Digest Matches

true

03:10:53:ac:b1:ff:a8:f9:1f:14:65:c0:e5:3a:1e:bf:84:9b:9c:9f
Signer

Actual PE Digest

03:10:53:ac:b1:ff:a8:f9:1f:14:65:c0:e5:3a:1e:bf:84:9b:9c:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

crypt32

CryptMsgClose

Exports

Exports

AVClose
AVInitialise
AVRetrieveInstanceInfo
AVScanObject
AVUpdate
RetrieveExtensionLists
RetrieveSingleExtensionList

Sections

.MPRESS1
Size: 17.5MB - Virtual size: 40.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

d35aaf46ab067e39dc24c90fe5e07bdd

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

30:30:23:24:82:ea:69:a8:e8:69:4b:cbCertificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

36:89:c4:13:24:8e:63:d3:a2:78:b4:eaCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:d8:a6:29:68:3c:8b:28:b7:64:a2:03:98:79:97:78:f0:9a:19:7e:4f:80:6a:96:fe:40:65:90:a9:76:ee:abSigner

03:10:53:ac:b1:ff:a8:f9:1f:14:65:c0:e5:3a:1e:bf:84:9b:9c:9fSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

crypt32

Exports

Exports

Sections

.MPRESS1 Size: 17.5MB - Virtual size: 40.0MB

.MPRESS2 Size: 3KB - Virtual size: 3KB

.rsrc Size: 142KB - Virtual size: 141KB

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

30:30:23:24:82:ea:69:a8:e8:69:4b:cb
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:d8:a6:29:68:3c:8b:28:b7:64:a2:03:98:79:97:78:f0:9a:19:7e:4f:80:6a:96:fe:40:65:90:a9:76:ee:ab
Signer

03:10:53:ac:b1:ff:a8:f9:1f:14:65:c0:e5:3a:1e:bf:84:9b:9c:9f
Signer

.MPRESS1
Size: 17.5MB - Virtual size: 40.0MB

.MPRESS2
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 142KB - Virtual size: 141KB