14303266781[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

14303266781.zip
Size

325KB
MD5

8b80095fc9c06d8bdf29bb3db3cc3182
SHA1

bac04d4c3bc5123d48e5c54b1aeb646310f01046
SHA256

b1b09929a3ecf5fa784568b8a4d341181581f4a39f12ad3264bc0f8939c68ef6
SHA512

faa7e1bd9421c05fe3e4804448533da4e82a33dc6f01528f4029d85200c5a48f4f43df631d952db913f9480618392f5e4b8cae2b804a89b9acde86b11c052ce7
SSDEEP

6144:uIDFPWan9/sJpHL28GK/qOJBdyneFzvGfTfWia885veswgbx2Ft:dDhW6NsJdL7CO3dHFzILWP8s3bat

Score

1^/10

Malware Config

Signatures

Files

14303266781.zip
.zip

Password: infected
1550a30be74ab0d21692e85bb0851fc499d6d5254fab621aacfba7a1ecc7bf1d
.exe windows:4 windows x86 arch:x86

Password: infected

b1c6a4ce4d829d1b71c55ffaa3023b4f

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:c8:1f:93:a9:e6:22:ce:00:a9:48:8f:cd:f4:fc:0e
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

14-02-2023 00:00

Not After

13-02-2026 23:59

Subject

CN=Nanjing Wangya Computer Co.\,Ltd.,O=Nanjing Wangya Computer Co.\,Ltd.,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

81:18:98:d0:f7:96:00:0d:93:bd:45:06:d3:56:c0:1c:0a:12:9e:da
Signer

Actual PE Digest

81:18:98:d0:f7:96:00:0d:93:bd:45:06:d3:56:c0:1c:0a:12:9e:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaLineInputStr
ord588
__vbaFreeVarList
__vbaEnd
__vbaPut3
_adj_fdiv_m64
__vbaVarIndexStore
__vbaRaiseEvent
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
ord626
ord550
__vbaCopyBytes
__vbaVarCmpNe
__vbaStrCat
__vbaForEachCollAd
__vbaCyInt
__vbaLsetFixstr
ord660
ord553
ord661
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenBstrB
__vbaNameFile
_adj_fdiv_m32
ord666
__vbaAryVar
__vbaAryDestruct
ord669
__vbaExitProc
ord593
__vbaForEachCollObj
ord300
ord594
__vbaI4Abs
ord301
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
ord305
__vbaFpR4
ord599
ord306
__vbaBoolVar
ord520
__vbaStrFixstr
ord307
ord522
ord309
__vbaRefVarAry
__vbaBoolVarNull
__vbaFpR8
__vbaVarTstLt
_CIsin
ord709
ord524
ord631
__vbaErase
__vbaVarZero
ord525
ord632
__vbaNextEachCollObj
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord527
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaGet3
ord529
__vbaGet4
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner3
__vbaDateR8
__vbaI2I4
__vbaObjVar
__vbaPrintObj
DllFunctionCall
__vbaVarOr
__vbaVarLateMemSt
__vbaFpUI1
__vbaCySub
__vbaCastObjVar
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
ord568
__vbaLateIdCallLd
__vbaR8Cy
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
ord311
EVENT_SINK_QueryInterface
__vbaFpCmpCy
__vbaVarMul
__vbaStrUI1
__vbaStr2Vec
__vbaUI1I4
__vbaExceptHandler
ord711
ord313
__vbaStrToUnicode
ord712
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
ord714
__vbaI2Str
ord607
__vbaLateIdStAd
__vbaVarDiv
ord608
__vbaVarCmpLe
__vbaFPException
ord717
__vbaInStrVar
__vbaGetOwner3
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaR4ForNextCheck
__vbaDateVar
ord535
__vbaCheckType
__vbaLsetFixstrFree
__vbaI2Var
ord644
ord537
__vbaFileSeek
__vbaExitEachVar
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaVarLateMemCallLdRf
__vbaNew2
ord648
__vbaInStr
ord570
__vbaCyMulI2
__vbaVarInt
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
__vbaVarSetObj
ord681
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord578
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
ord689
__vbaFpCy
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
__vbaStrComp
__vbaStrToAnsi
__vbaVarDup
__vbaVerifyVarObj
__vbaFpI2
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
ord616
ord617
__vbaVarSetObjAddref
__vbaR8IntI2
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaI2ErrVar
__vbaCastObj
__vbaStrMove
__vbaAryCopy
ord618
__vbaUI1Str
__vbaI4Cy
__vbaR8IntI4
__vbaForEachVar
ord619
__vbaStrVarCopy
ord542
_allmul
__vbaLateIdSt
__vbaLenVarB
ord545
__vbaAryRecCopy
_CItan
ord546
__vbaNextEachCollAd
__vbaAryUnlock
__vbaFPInt
ord547
__vbaUI1Var
ord548
__vbaFpCSngR8
_CIexp
__vbaMidStmtBstr
__vbaFreeObj
__vbaFreeStr
__vbaI4ErrVar
ord580
ord581

Sections

.text
Size: 928KB - Virtual size: 924KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b1c6a4ce4d829d1b71c55ffaa3023b4f

Code Sign

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b4:c8:1f:93:a9:e6:22:ce:00:a9:48:8f:cd:f4:fc:0eCertificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

81:18:98:d0:f7:96:00:0d:93:bd:45:06:d3:56:c0:1c:0a:12:9e:daSigner

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 928KB - Virtual size: 924KB

.data Size: 4KB - Virtual size: 24KB

.rsrc Size: 16KB - Virtual size: 13KB

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b4:c8:1f:93:a9:e6:22:ce:00:a9:48:8f:cd:f4:fc:0e
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

81:18:98:d0:f7:96:00:0d:93:bd:45:06:d3:56:c0:1c:0a:12:9e:da
Signer

.text
Size: 928KB - Virtual size: 924KB

.data
Size: 4KB - Virtual size: 24KB

.rsrc
Size: 16KB - Virtual size: 13KB