HRMS26_2024-01-06_01_57_39[.]130[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

HRMS26_2024-01-06_01_57_39.130.zip
Size

58KB
MD5

2bdd78e97a87a87d8cba4ddb268d5bdc
SHA1

4ace9b9f77442be68fd1c0d0819dc6684a8a20bb
SHA256

098d3daf3fb29e574846c5c1acb61358ba17f66aadb54522d073f1b77b7095f8
SHA512

b417e4391f156294bd05b07f326d65e022c8a7c964fd960dd5b87af81a875840cd7f7e096c50e17e5de1df08137680d29e72d4781d4088331e8da71c02b8b85a
SSDEEP

1536:NNHmG0EGRmRi3tTYd1c0RbKj2u3/jQd16DjK4UpJOXUUAG:TG921HBbarQT3pokA

Score

1^/10

Malware Config

Signatures

Files

HRMS26_2024-01-06_01_57_39.130.zip
.zip

Password: n2TDTH1UcA943Aou1e2N
Device/HarddiskVolume2/Windows/Installer/MSI4F59.tmp
.exe windows:5 windows x86 arch:x86

Password: n2TDTH1UcA943Aou1e2N

12e24c25fc17eddc6e5bb65d5a4df6ad

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

74:ba:c3:09:67:39:1b:08:24:2d:79:f7:f7:94:49:e2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/02/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:9e:66:a4:4e:85:e1:59:13:bf:15:e4:68:27:6f:77:a5:ef:b8:4f
Signer

Actual PE Digest

5c:9e:66:a4:4e:85:e1:59:13:bf:15:e4:68:27:6f:77:a5:ef:b8:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpSendRequestExW
HttpOpenRequestW
InternetSetOptionW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetOpenW

kernel32

HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
OpenProcess
WaitForSingleObject
GetExitCodeProcess
CloseHandle
OpenThread
WaitForMultipleObjects
GetExitCodeThread
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetThreadTimes
FindFirstFileW
RaiseException
InitializeCriticalSectionAndSpinCount
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
HeapSize
GetPrivateProfileStringW
GetTempPathW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetConsoleMode
GetConsoleCP
LCMapStringW
HeapDestroy
MultiByteToWideChar
GetLastError
SetFilePointerEx
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
LoadLibraryExW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
IsProcessorFeaturePresent
GetCommandLineW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStdHandle
WriteFile
GetModuleFileNameW
GetStringTypeW
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind

psapi

GetProcessImageFileNameW

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: n2TDTH1UcA943Aou1e2N

Password: n2TDTH1UcA943Aou1e2N

12e24c25fc17eddc6e5bb65d5a4df6ad

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

74:ba:c3:09:67:39:1b:08:24:2d:79:f7:f7:94:49:e2Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5c:9e:66:a4:4e:85:e1:59:13:bf:15:e4:68:27:6f:77:a5:ef:b8:4fSigner

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

psapi

Sections

.text Size: 66KB - Virtual size: 65KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

74:ba:c3:09:67:39:1b:08:24:2d:79:f7:f7:94:49:e2
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5c:9e:66:a4:4e:85:e1:59:13:bf:15:e4:68:27:6f:77:a5:ef:b8:4f
Signer

.text
Size: 66KB - Virtual size: 65KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB