41c063b5a5bf6d0dfce5a6a43d633b02[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

41c063b5a5bf6d0dfce5a6a43d633b02.zip
Size

338KB
MD5

41c063b5a5bf6d0dfce5a6a43d633b02
SHA1

7f398db19501baaa7bf3d02f78d8478c7edd3925
SHA256

6e1de8d920d78be42e3055b1e70a063e443f6b9fa8bb280eec8f170e74fd494e
SHA512

748d242ef0176eb4587b0660ad1f9aa651be8373e8117d09e41f233a214e8c64df29274f5843bde4b92cbcf7e7ffd4737762459e72dda17bb496cb149fc546ae
SSDEEP

6144:Z65sLKiViyp2m0MycULiayMe4HkvVrqDuUAp40ZpzgvLi56z:A55zypMzHIsHk9mhA+0ZKvLiEz

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/MachineGUID.dll	acprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MachineGUID.dll

Files

41c063b5a5bf6d0dfce5a6a43d633b02.zip
.zip
360rsp.exe
.exe windows:5 windows x86 arch:x86

d2e49417a3bdf69250fd4f8e9d5dbce4

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26-01-2010 00:00

Not After

25-01-2013 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

60:a0:53:9e:27:c3:1e:ed:59:c6:80:24:8a:88:8d:4c:04:8e:17:8c
Signer

Actual PE Digest

60:a0:53:9e:27:c3:1e:ed:59:c6:80:24:8a:88:8d:4c:04:8e:17:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSQueryUserToken

kernel32

GetModuleHandleW
GetExitCodeProcess
GetVersionExW
GetProcAddress
GetSystemInfo
WaitForSingleObject
SetEvent
TerminateThread
CreateEventW
WaitForMultipleObjects
DeleteFileW
WideCharToMultiByte
MultiByteToWideChar
GetSystemDefaultLangID
GetCommandLineW
CreateMutexW
GetCurrentProcess
Sleep
FlushInstructionCache
RaiseException
GetLastError
SetLastError
GetCurrentThreadId
GetPrivateProfileStringW
ReadFile
WritePrivateProfileStringW
GetPrivateProfileIntW
LocalAlloc
WTSGetActiveConsoleSessionId
LocalFree
FreeLibrary
LoadLibraryW
GetSystemTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
lstrlenW
IsProcessorFeaturePresent
ExitProcess
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetModuleHandleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
OutputDebugStringW
GetStringTypeA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
GetFileType
SetHandleCount
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
GetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CloseHandle
CreateFileW
GetModuleFileNameW
GetFileAttributesW
lstrcpynW
WriteFile
MoveFileExW
CreateDirectoryW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenA
GetProcessHeap
GetUserDefaultLCID
IsBadReadPtr
ResetEvent
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetStringTypeW
LCMapStringW
InterlockedExchange
TerminateProcess
LCMapStringA
GetCPInfo
RtlUnwind
GetCurrentProcessId
GetStartupInfoW
GetSystemTimeAsFileTime
CreateThread
ExitThread
HeapAlloc
HeapReAlloc
HeapFree
IsDebuggerPresent
UnhandledExceptionFilter

user32

SendMessageW
ShowWindow
MapWindowPoints
SetWindowLongW
GetDlgItem
MonitorFromWindow
SetWindowTextW
GetMonitorInfoW
SetWindowPos
CallNextHookEx
EnableMenuItem
GetWindowLongW
GetClientRect
GetParent
GetWindowRect
GetSystemMenu
DestroyWindow
CallWindowProcW
DestroyIcon
FlashWindow
KillTimer
PostMessageW
LoadImageW
RegisterWindowMessageW
PostQuitMessage
SetTimer
DispatchMessageW
MessageBoxW
CreateDialogParamW
GetDesktopWindow
TranslateMessage
FindWindowW
SetForegroundWindow
GetMessageW
SendMessageTimeoutW
DefWindowProcW
UnhookWindowsHookEx
SetWindowsHookExW
CreateWindowExW
SystemParametersInfoW
RegisterClassExW
GetClassInfoW
LoadCursorW
UnregisterClassA
GetWindow

gdi32

SetBkMode
DeleteObject
CreateSolidBrush

advapi32

RegOpenKeyW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation

shell32

ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CLSIDFromProgID
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoLoadLibrary
CoFreeLibrary

oleaut32

SysFreeString
SysAllocStringByteLen

ws2_32

select
htonl
WSAStartup
WSAGetLastError
htons
ntohs
setsockopt
WSACleanup
recv
gethostbyname
send
getsockopt
ntohl
shutdown
socket
closesocket
ioctlsocket
connect

shlwapi

PathRemoveFileSpecW
PathFileExistsW
wnsprintfW

wininet

InternetQueryOptionW
InternetOpenW
InternetOpenUrlW
InternetCrackUrlW
InternetConnectW
InternetSetOptionW
InternetCloseHandle
HttpSendRequestW
HttpOpenRequestW
InternetReadFile

Sections

.text
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
456Login.dll
MachineGUID.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetMachineGUID

Sections

CODE
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d2e49417a3bdf69250fd4f8e9d5dbce4

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

60:a0:53:9e:27:c3:1e:ed:59:c6:80:24:8a:88:8d:4c:04:8e:17:8cSigner

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wininet

Sections

.text Size: 410KB - Virtual size: 410KB

.rdata Size: 59KB - Virtual size: 58KB

.data Size: 10KB - Virtual size: 23KB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 76KB - Virtual size: 76KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

CODE Size: - Virtual size: 40KB

DATA Size: 21KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 4KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

60:a0:53:9e:27:c3:1e:ed:59:c6:80:24:8a:88:8d:4c:04:8e:17:8c
Signer

.text
Size: 410KB - Virtual size: 410KB

.rdata
Size: 59KB - Virtual size: 58KB

.data
Size: 10KB - Virtual size: 23KB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 76KB - Virtual size: 76KB

CODE
Size: - Virtual size: 40KB

DATA
Size: 21KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 4KB