MDE_File_Sample_0b39336bf2b145cc8662ef73999379f8a45ee843749a3db3427ef3ce5ebf7458[.]zip

Resubmissions

06-10-2023 14:31

231006-rvs2kafa68 1

Sharing

Copy URL

Twitter E-mail

General

Target

MDE_File_Sample_0b39336bf2b145cc8662ef73999379f8a45ee843749a3db3427ef3ce5ebf7458.zip
Size

1.8MB
MD5

ca54e312c5eccfc5d052a5ae25b3dfb7
SHA1

6f9f61ef4fe6f6a5946f575d5e5a7485d6b0faf4
SHA256

4e1240a29bd8f351055f5b7310a6b588d618d40e52315c92d352a1397391c3d7
SHA512

2361fa1b39cda0ac3f7baf0529a8a507a6660ee62ca77e0059ff58dc9ced1ee931b38547e1723fc7373bc4d68a925b62856d156b420e6cc5a2a61902722f9b2d
SSDEEP

24576:5PAjEmVKhORfcuoazzuFG0lQd4oWSVhwqilILrbeCp1y7ZcIGwi4uJnh4hNx/2IG:5VhORPNsauAOSfeCW7ZE4uJ6x/P2gtFu

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_0b39336bf2b145cc8662ef73999379f8a45ee843749a3db3427ef3ce5ebf7458.zip
.zip

Password: 123
ra.dll
.dll windows:6 windows x64

Password: 123

95518a89c53d075ab58b8de3513558b8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:cf:d0:8a:3c:ee:97:36:73:d5:22:54:d4:32:ba:db
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20-04-2022 00:00

Not After

11-05-2023 23:59

Subject

CN=Veriato\, Inc.,O=Veriato\, Inc.,L=Palm Beach Gardens,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b7:d2:43:07:81:56:6f:78:66:d9:80:83:20:1e:9c:a8:fc:4d:2f:44
Signer

Actual PE Digest

b7:d2:43:07:81:56:6f:78:66:d9:80:83:20:1e:9c:a8:fc:4d:2f:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

psapi

GetMappedFileNameW

wsock32

socket
recv
connect
closesocket
gethostbyname
send
WSACleanup
WSAStartup
gethostbyaddr

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

mpr

WNetGetConnectionA

advapi32

RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueA
GetSidSubAuthority
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
GetUserNameA
RegQueryValueExW
RegGetValueW
OpenProcessToken
RegEnumKeyExW
GetTokenInformation
MakeSelfRelativeSD
GetSecurityDescriptorLength
FreeSid
IsValidSecurityDescriptor
GetSecurityDescriptorControl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetEntriesInAclW
GetSecurityDescriptorSacl
GetSidSubAuthorityCount

shlwapi

PathFileExistsW
PathFileExistsA
PathIsRelativeW
PathFindFileNameA

ws2_32

getsockopt
__WSAFDIsSet
WSAStringToAddressA
WSAGetLastError
FreeAddrInfoExW
FreeAddrInfoW
freeaddrinfo
select
WSASetLastError
setsockopt
sendto

user32

FindWindowA
LoadIconA
LoadCursorA
DestroyWindow
CreateWindowExA
RegisterClassA
DispatchMessageA
TranslateMessage
GetMessageA
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
GetKeyState
GetKeyboardLayoutNameA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
MoveWindow
PostMessageA
GetWindow
CharNextW
CharPrevA
UnregisterClassA
SetWindowLongPtrA
RemovePropA
GetPropA
SetPropA
SetCursor
IsWindowEnabled
CallWindowProcA
SendMessageA
GetWindowRect
GetWindowTextLengthA
GetFocus
wsprintfW
LoadStringA
CharNextA
KillTimer
SetTimer
IsWindow
SendMessageTimeoutA
RegisterWindowMessageA
GetParent
GetClassNameA
FindWindowExA
EnumChildWindows
GetWindowLongA
GetWindowTextA
IsWindowVisible
DefWindowProcA
PostThreadMessageA
GetUserObjectInformationA
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
OpenWindowStationA
GetThreadDesktop
CloseDesktop
SetThreadDesktop
MapVirtualKeyA
GetKeyboardLayout
wsprintfA
CharPrevW

kernel32

ExitProcess
GetFileInformationByHandle
GetDriveTypeW
GetFileType
GetModuleHandleExW
EnumSystemLocalesW
GetStdHandle
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
IsValidLocale
SetFileAttributesW
GetCurrentDirectoryW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetStringTypeW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
IsDebuggerPresent
RtlUnwindEx
GetUserDefaultLCID
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
LoadLibraryExA
CompareStringA
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CreateMutexA
ReadDirectoryChangesW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
GetThreadPriority
TerminateProcess
GetCurrentDirectoryA
SetCurrentDirectoryA
GetNumberFormatA
GetTimeZoneInformation
LocalReAlloc
ReleaseMutex
Process32FirstW
CreateToolhelp32Snapshot
Process32NextW
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
VerSetConditionMask
FlushFileBuffers
ReadFile
WriteFile
CloseHandle
ConnectNamedPipe
DisconnectNamedPipe
PeekNamedPipe
GetOverlappedResult
SetEvent
WaitForSingleObject
CreateEventA
GetTickCount
FreeLibrary
GetModuleFileNameA
GetProcAddress
LocalAlloc
WaitForMultipleObjects
LoadLibraryA
CreateNamedPipeA
CallNamedPipeA
VerifyVersionInfoW
CreateFileA
InitializeCriticalSection
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetCurrentThread
GetModuleHandleA
CreateThread
GetCurrentThreadId
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
GetTempPathA
GetTempFileNameA
GetCommandLineA
CreateDirectoryA
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
GetCurrentProcessId
GetLocalTime
GetWindowsDirectoryA
GetFileAttributesExA
ResetEvent
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExA
LoadResource
LockResource
SizeofResource
lstrcmpiA
FindResourceA
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
ExpandEnvironmentStringsA
GetDriveTypeA
SetFilePointerEx
GetTempPathW
QueryDosDeviceA
GetACP
GetTickCount64
SystemTimeToFileTime
GetModuleHandleW
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
LocalFree
GetSystemDirectoryA
GetTimeFormatA
GetLocaleInfoA
GetProcessTimes
GetSystemTimes
DuplicateHandle
OpenProcess
GetComputerNameA
VirtualProtect
VirtualQuery
IsBadStringPtrA
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
GetConsoleTitleA
SetConsoleTitleA
GetVersionExW
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
GetProcessHeap
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
HeapSize
HeapValidate
GetFileAttributesW
CreateFileW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
TryEnterCriticalSection
lstrlenA
CreateEventW
GetModuleFileNameW
MoveFileA
ProcessIdToSessionId
ResumeThread
TerminateThread
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
GetProcessId

gdi32

GetStockObject
TranslateCharsetInfo

winspool.drv

GetJobA

shell32

SHGetFolderPathA
CommandLineToArgvW
SHGetKnownFolderPath
SHGetFolderPathW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitialize
StringFromCLSID
CoTaskMemRealloc
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

SysStringLen
SafeArrayUnaccessData
SysAllocString
SafeArrayAccessData
SysAllocStringLen
VariantChangeType
VariantCopy
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
FreeResources
IAlloc
InitializeDll
SetPassthruFlag

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

95518a89c53d075ab58b8de3513558b8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:cf:d0:8a:3c:ee:97:36:73:d5:22:54:d4:32:ba:dbCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

b7:d2:43:07:81:56:6f:78:66:d9:80:83:20:1e:9c:a8:fc:4d:2f:44Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

wsock32

version

mpr

advapi32

shlwapi

ws2_32

user32

kernel32

gdi32

winspool.drv

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.data Size: 37KB - Virtual size: 128KB

.pdata Size: 162KB - Virtual size: 162KB

.idata Size: 14KB - Virtual size: 13KB

.shared Size: 512B - Virtual size: 40B

.tls Size: 512B - Virtual size: 109B

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 440B

.reloc Size: 16KB - Virtual size: 16KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:cf:d0:8a:3c:ee:97:36:73:d5:22:54:d4:32:ba:db
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

b7:d2:43:07:81:56:6f:78:66:d9:80:83:20:1e:9c:a8:fc:4d:2f:44
Signer

.text
Size: 3.9MB - Virtual size: 3.9MB

.data
Size: 37KB - Virtual size: 128KB

.pdata
Size: 162KB - Virtual size: 162KB

.idata
Size: 14KB - Virtual size: 13KB

.shared
Size: 512B - Virtual size: 40B

.tls
Size: 512B - Virtual size: 109B

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 440B

.reloc
Size: 16KB - Virtual size: 16KB