0aa5af0d44eb63e52c62fcb3a9da8cbaf5a4ee329c47e3d692519189eaadd653[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

0aa5af0d44eb63e52c62fcb3a9da8cbaf5a4ee329c47e3d692519189eaadd653.exe.zip
Size

2.5MB
MD5

595e74e768dce1456828db3894afe7d9
SHA1

e72e66a1bf1cd328c2ee27ec8b6db0549364d8e7
SHA256

01e9b9e89f765674e7ec88c6b059848ed52eaf0847b973d481fa08b5833841e2
SHA512

e00d9f084978446969b76bc36cfaa5c93070b595c2fd0995a11cad42e24c313efcb4430075f0941015ca5acff30f31fff62a65a6defb016ed307c753b5e194f7
SSDEEP

49152:FAWSIXW/sDM5CmbIj4ckZFCWWY5dj8SPgsrwBvV8B02bCA4:mW9XZDXkO4QtrZe5CA4

Score

1^/10

Malware Config

Signatures

Files

0aa5af0d44eb63e52c62fcb3a9da8cbaf5a4ee329c47e3d692519189eaadd653.exe.zip
.zip

Password: infected
0aa5af0d44eb63e52c62fcb3a9da8cbaf5a4ee329c47e3d692519189eaadd653.exe
.exe windows:5 windows x86

4df33c22337bab1533add9a247f22b58

Code Sign

09:f6:f0:84:76:4b:3f:f5:68:6b:21:3d:91:d8:ab:64
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/10/2017, 00:00

Not After

29/11/2019, 12:00

Subject

CN=Letasoft LLC,O=Letasoft LLC,L=Surrey,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:8e:a7:40:ab:c6:bd:59:3a:ab:9c:a3:32:9c:e1:b4
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/10/2017, 00:00

Not After

29/11/2019, 12:00

Subject

CN=Letasoft LLC,O=Letasoft LLC,L=Surrey,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:59:71:5e:9f:f4:ad:d2:36:29:0e:a6:35:c3:80:ad:94:c4:67:22:03:fb:34:f7:84:1a:e1:d8:01:1d:75:16
Signer

Actual PE Digest

1c:59:71:5e:9f:f4:ad:d2:36:29:0e:a6:35:c3:80:ad:94:c4:67:22:03:fb:34:f7:84:1a:e1:d8:01:1d:75:16

Digest Algorithm

sha256

PE Digest Matches

true

9d:35:6a:bc:50:e4:7f:a0:3a:88:31:20:a0:a4:9d:12:4c:5d:42:91
Signer

Actual PE Digest

9d:35:6a:bc:50:e4:7f:a0:3a:88:31:20:a0:a4:9d:12:4c:5d:42:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenUrlW

sbh

KLHGetManager

kernel32

GetVersionExW
EnumResourceNamesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

UnhookWindowsHookEx

gdi32

SetStretchBltMode

winspool.drv

ClosePrinter

advapi32

RegQueryValueW

shell32

SHGetFolderPathW

comctl32

ImageList_Draw

shlwapi

PathAppendW

ole32

CoUninitialize

oleaut32

SysFreeString

netapi32

NetWkstaGetInfo

version

VerQueryValueW

dbghelp

MiniDumpWriteDump

oleacc

CreateStdAccessibleObject

Sections

.text
Size: - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

4df33c22337bab1533add9a247f22b58

Code Sign

09:f6:f0:84:76:4b:3f:f5:68:6b:21:3d:91:d8:ab:64Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

07:8e:a7:40:ab:c6:bd:59:3a:ab:9c:a3:32:9c:e1:b4Certificate

Extended Key Usages

Key Usages

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

1c:59:71:5e:9f:f4:ad:d2:36:29:0e:a6:35:c3:80:ad:94:c4:67:22:03:fb:34:f7:84:1a:e1:d8:01:1d:75:16Signer

9d:35:6a:bc:50:e4:7f:a0:3a:88:31:20:a0:a4:9d:12:4c:5d:42:91Signer

Headers

DLL Characteristics

File Characteristics

Imports

wininet

sbh

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

netapi32

version

dbghelp

oleacc

Sections

.text Size: - Virtual size: 300KB

.rdata Size: - Virtual size: 104KB

.data Size: - Virtual size: 20KB

.gfids Size: - Virtual size: 6KB

.giats Size: - Virtual size: 4B

.tls Size: 512B - Virtual size: 9B

.vmp0 Size: - Virtual size: 2.2MB

.vmp1 Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 512B - Virtual size: 320B

.rsrc Size: 292KB - Virtual size: 291KB

09:f6:f0:84:76:4b:3f:f5:68:6b:21:3d:91:d8:ab:64
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

07:8e:a7:40:ab:c6:bd:59:3a:ab:9c:a3:32:9c:e1:b4
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

1c:59:71:5e:9f:f4:ad:d2:36:29:0e:a6:35:c3:80:ad:94:c4:67:22:03:fb:34:f7:84:1a:e1:d8:01:1d:75:16
Signer

9d:35:6a:bc:50:e4:7f:a0:3a:88:31:20:a0:a4:9d:12:4c:5d:42:91
Signer

.text
Size: - Virtual size: 300KB

.rdata
Size: - Virtual size: 104KB

.data
Size: - Virtual size: 20KB

.gfids
Size: - Virtual size: 6KB

.giats
Size: - Virtual size: 4B

.tls
Size: 512B - Virtual size: 9B

.vmp0
Size: - Virtual size: 2.2MB

.vmp1
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 512B - Virtual size: 320B

.rsrc
Size: 292KB - Virtual size: 291KB