14439639506[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

14439639506.zip
Size

267KB
MD5

2a17e36cfa9ef44d544d26f2ef88cff1
SHA1

6bec8f6cff7b2ebc3da6366f0759bd898052f45c
SHA256

ed3b86efe501c88cbf07bb7192eb725cd36b0947a794c169dd13dff31179ace5
SHA512

5002e8e46fbc61c2addc265dc2c9492ac9d23b77c505ea301af2a0a1c61bed2ba0727c9d74cada2eb77101d7a1d26d623b39bc4e708eae7ae13990ee5f7d083d
SSDEEP

6144:mnQTID7DNkd5jF2Ia6XjRSV340MapfRvObD9sMC2qpSljB:YSmHeW6TRsIPupvE9gy9

Score

1^/10

Malware Config

Signatures

Files

14439639506.zip
.zip

Password: infected
812f9dbe2e5bfbca575a21a0aeb54c392c0bc7a5c8a88c5849fd0a72bd69aa9e
.exe windows:4 windows x86 arch:x86

Password: infected

d47679f1561ae383379157c808105e68

Code Sign

b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0f
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/04/2019, 00:00

Not After

02/04/2020, 23:59

Subject

CN=SLON LTD,O=SLON LTD,POSTALCODE=SM2 6SQ,STREET=28 Sandown Court Grange Road,L=SUTTON,ST=SUTTON,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01/02/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:08:2b:19:a1:86:66:4a:47:0a:21:51:ac:fb:b3:a7:6a:78:1f:4c
Signer

Actual PE Digest

61:08:2b:19:a1:86:66:4a:47:0a:21:51:ac:fb:b3:a7:6a:78:1f:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
GetProcAddress
LoadLibraryA
GetLastError
GetCurrentProcess
GetProcessHeap
GetACP
lstrlenA
HeapAlloc
GetVersionExA
HeapDestroy
GetVersionExW
LCMapStringW
GetCommandLineA
VirtualAlloc
GetModuleHandleA
GetCommandLineW
InterlockedDecrement
InterlockedIncrement
GetTickCount
GetStartupInfoA

user32

PostMessageW
GetSubMenu
SetWindowPos
GetMenuStringW
GetMenu
DestroyWindow
DestroyIcon
CreateWindowExA
RegisterClassW
DefWindowProcW
SetWindowTextW
LoadStringW
UnregisterClassA
SetWindowLongW
ReleaseDC
SendMessageW
ReleaseCapture
GetActiveWindow

advapi32

RegOpenKeyExW
RegEnumValueA
RegOpenKeyExA
RegSetValueExA

comctl32

ImageList_Add

wintrust

WinVerifyTrust

msvcrt

_onexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
__dllonexit

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d47679f1561ae383379157c808105e68

Code Sign

b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0fCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

61:08:2b:19:a1:86:66:4a:47:0a:21:51:ac:fb:b3:a7:6a:78:1f:4cSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

comctl32

wintrust

msvcrt

Sections

.text Size: 120KB - Virtual size: 118KB

.data Size: 264KB - Virtual size: 261KB

.reloc Size: 4KB - Virtual size: 1KB

b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0f
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

61:08:2b:19:a1:86:66:4a:47:0a:21:51:ac:fb:b3:a7:6a:78:1f:4c
Signer

.text
Size: 120KB - Virtual size: 118KB

.data
Size: 264KB - Virtual size: 261KB

.reloc
Size: 4KB - Virtual size: 1KB