swift[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

swift.zip
Size

345KB
MD5

092a1eb360bd4c9dfe9865c44f3e5d69
SHA1

d240003cb29aec673404ad4b8cba8d629ae6773d
SHA256

27b2fffcda896e66d7394a0a04d8622143e1254fea38832f5656edd625a09fd5
SHA512

533fce70d46bee51fe12ffa26a1a3adc308311259a2daa9c54f2538f9bcc656cb9b87b110d8fbc5a6b7f2b99b7c8cc7c2c7bb78670166bafe1496b5bf42d97c3
SSDEEP

6144:R8xvZYV04wyORyB2sYHyZnyWRWmWUGVQ5vtZzK2XyKGOL+7Ze/tr9w3:Ev+G4wDClYHyZ7CJ23xTyB7Zer6

Score

1^/10

Malware Config

Signatures

Files

swift.zip
.zip
swift.exe
.exe windows:6 windows x64

3eb4068739a715fcb255801b056ec9db

Code Sign

56:b6:29:cd:34:bc:78:f6
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

31/05/2017, 18:14

Not After

30/05/2042, 18:14

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:22:33:0a:77:fe:6a:84:a1:54:27:c8:33:cd:86:9e
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

12/10/2023, 15:58

Not After

10/10/2024, 15:58

Subject

SERIALNUMBER=07523668,CN=ANDAPAK CORRUGATED SALES LIMITED,O=ANDAPAK CORRUGATED SALES LIMITED,L=Nottingham,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26/03/2019, 17:44

Not After

22/03/2034, 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:bd:45:95:b2:77:5b:25:5f:9e:da:71:41:5c:91:2f:cf:0f:7a:e5:8c:ea:71:af:3d:a2:f9:26:90:ef:b4:55
Signer

Actual PE Digest

4f:bd:45:95:b2:77:5b:25:5f:9e:da:71:41:5c:91:2f:cf:0f:7a:e5:8c:ea:71:af:3d:a2:f9:26:90:ef:b4:55

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
HeapReAlloc
WriteFile
GetStdHandle
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
GetCPInfo
TerminateProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
HeapSize
WideCharToMultiByte
GetModuleHandleExW
RtlPcToFileHeader
GetCommandLineW
IsProcessorFeaturePresent
EncodePointer
OutputDebugStringW
IsDebuggerPresent
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
CloseHandle
MultiByteToWideChar
FindResourceW
LoadLibraryW
lstrlenW
lstrlenA
lstrcpyW
lstrcpynW
lstrcpynA
lstrcmpiW
lstrcmpW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
LoadLibraryExA
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetVersionExW
FlushInstructionCache
GetCurrentThreadId
ExitProcess
GetCurrentProcessId
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
TlsAlloc
DecodePointer

user32

SystemParametersInfoW
LoadImageW
LoadCursorW
LoadBitmapW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetWindowThreadProcessId
GetClassNameW
MonitorFromWindow
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
LoadStringA
LoadStringW
wvsprintfW
RegisterWindowMessageW
DrawEdge
DrawFrameControl
GetMessageW
GetMonitorInfoW
GetParent
GetWindowLongW
PtInRect
IsRectEmpty
OffsetRect
InflateRect
SetRectEmpty
FrameRect
FillRect
GetSysColorBrush
GetSysColor
WindowFromPoint
MapWindowPoints
ScreenToClient
MessageBeep
GetWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
DrawTextW
SetMenuDefaultItem
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenuEx
RemoveMenu
ModifyMenuW
AppendMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
DestroyMenu
CreatePopupMenu
SetMenu
GetMenu
LoadMenuW
GetSystemMetrics
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
CharLowerW
GetDlgItem
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
GetMessagePos
PeekMessageW
DispatchMessageW
TranslateMessage
MonitorFromPoint

gdi32

ExtTextOutW
GetObjectW
CreateDIBSection
SetTextColor
SetBkMode
SetBkColor
BitBlt
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreatePatternBrush
CreateRectRgnIndirect
DeleteDC
DeleteObject
ExcludeClipRect
GetCurrentObject
GetStockObject
SetBrushOrgEx
SelectObject
PatBlt

advapi32

RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VarUI4FromStr

comctl32

ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_Draw
ImageList_AddMasked
ImageList_DrawIndirect
ImageList_LoadImageW
ord8
InitCommonControlsEx
CreateStatusWindowW

Exports

Exports

AFnWqCXGQewdTht
AGSBKZS
AuPyrWI
BBZUvykQlec
BqbpzHBBVhvzEPraEI
CJhumam
DayyPHzyVIoqCWAj
EIzNLlFCikeahgpEGqwZsxXLh
FlnPJtTPxZWloralaqDU
GMuJAlnAkUARwOMch
GTrYxKCvRHHWdZjuAD
HAyGEVxyISFuMlwOB
HKHTTYwJSdNoEHRFlAmIaAJL
HWiePDklXXyfAUfdd
HqyKhgri
IIgOAskzOsIDfUwQfWnuOTWOzw
JObJOqXIqeVPqxBLIxNVktt
JfjBuGWvnnvIIgspWVr
LEmiAmWjeO
LWDQDAuSGuo
NXTponGBJPqwvjExQiURQPeAqO
NrCBInxMuFRI
Ovlayw
QnprXewcDihLRrbuEM
QwLsTkEoNqoRRu
THaTqHtPbBijUDljcnQAIxV
TJNwJM
UixPsAbjFVemWVZqqvZTCajeM
UlqDGeA
VVBwXXxNxUo
VWQfKZnoNWS
VtbnzYAISevszQN
WgmBzo
WsUxPtd
XdmfqwAwltqsL
XsNuEculfROrCHznMZamkNHQMC
XxiBcsLphqweyianRiGRws
YVnVJpQZ
YdKolGOhGuwc
YnbAbDZgxqlLHLtZzovXPMkr
ZjsWKHcnwFbfNBXlIILNWr
bNShmPfGEUJDj
bTnMSMIxBGwXPsOyReV
beLwWyDrzsSjzWQ
cOzhxSjbgEQoSJhqwCtI
eQrDPADF
ebyczH
gjEECEBrMOunXvdIsk
goZBLnT
grrMNnB
iWgwaxaYqQJFchwyuBx
iqPlQkVQPumzUjaZAdpmBSYnAd
iuUUdOrdwTDs
kgDTLuczWbLMIcCIABCTIt
kmuskbHSmYXrjCBINzGhX
lSvUkXTTLQ
lTltiPmuxiSUVE
mHjtCicDqffaVyBkhnCkikfQKy
mTRMoZhTIJgNmJAhJHTo
mYxuIqWsUAvyIFvXMcpH
myGHlYHrjfdudVnA
nlzftfUqoQMJsPkgR
nyGvpbFwYUsx
poJdCDJzOwJEUDXBuRgWJ
qXGsDsFNH
sOIDPD
tDdMSfuJZ
thERfFIFukwKtYrKtV
tiSBDgHnaQjynZO
uYHYCBnStAXmpUMb
utkggpHLAlqpXuWFNVUzonD
ylYaLMOFD
yshMSzBZOAoPaBVKKrC
zLilNrrXGwvSucnCo

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 304KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3eb4068739a715fcb255801b056ec9db

Code Sign

56:b6:29:cd:34:bc:78:f6Certificate

Key Usages

4c:22:33:0a:77:fe:6a:84:a1:54:27:c8:33:cd:86:9eCertificate

Extended Key Usages

Key Usages

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

4f:bd:45:95:b2:77:5b:25:5f:9e:da:71:41:5c:91:2f:cf:0f:7a:e5:8c:ea:71:af:3d:a2:f9:26:90:ef:b4:55Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

Exports

Exports

Sections

.text Size: 199KB - Virtual size: 199KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 304KB - Virtual size: 314KB

.pdata Size: 12KB - Virtual size: 12KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 2KB - Virtual size: 1KB

56:b6:29:cd:34:bc:78:f6
Certificate

4c:22:33:0a:77:fe:6a:84:a1:54:27:c8:33:cd:86:9e
Certificate

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

4f:bd:45:95:b2:77:5b:25:5f:9e:da:71:41:5c:91:2f:cf:0f:7a:e5:8c:ea:71:af:3d:a2:f9:26:90:ef:b4:55
Signer

.text
Size: 199KB - Virtual size: 199KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 304KB - Virtual size: 314KB

.pdata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 2KB - Virtual size: 1KB